CVE-2026-71537
1 advisory.
Packagist/paymenter/paymenter CVE-2026-71537: medium 6.5, EPSS 0.33%
Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade)
Action: Upgrade paymenter/paymenter to 1.5.7 or later.
composer require paymenter/paymenter:1.5.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.5.7 | - |
Fixed versions
| 1.5.7 |
Sources
- osv: GHSA-5gmm-hjfj-8ff7
- https://github.com/Paymenter/Paymenter/security/advisories/GHSA-5gmm-hjfj-8ff7
- https://github.com/Paymenter/Paymenter/commit/a42e7f8bafce054ad70de3a2c2ac94d13579f41b
- https://github.com/Paymenter/Paymenter
- https://github.com/Paymenter/Paymenter/releases/tag/v1.5.7
CVE-2026-71537 · published · modified · JSON