{"id":"CVE-2026-86405","published":"2026-10-09T13:17:11.100","lastModified":"2026-10-12T23:17:45.413","description":"Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing by Improper Validation.\n\nThis issue affects PrestaShop Virtual POS Module: from 26.8.1 before 26.9.1.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-347"],"vendors":[],"products":[],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1287","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows attackers to spoof cryptographic signatures in the PrestaShop Virtual POS Module, enabling unauthorized modifications to payment transactions. The flaw occurs due to improper validation of digital signatures, making it possible for malicious actors to forge valid-looking transactions.","exploitability":"Exploitation is relatively straightforward requiring only network access to the affected module, with no authentication required for signature verification, though successful exploitation requires understanding the signature format and generation process.","blast_radius":"If exploited, this vulnerability could allow attackers to manipulate payment transactions across multiple stores using the affected PrestaShop module, potentially leading to unauthorized fund transfers and financial losses.","remediation":"Upgrade to version 26.9.1 or later to remediate this cryptographic signature verification flaw.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["signature","payment","prestashop","crypto"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:43:25.709Z"}}