EUVD-2026-277892

fkie_cve-2026-33661

Pay is an open-source payment SDK extension package for various Chinese payment services. Prior to version 3.7.20, the `verify_wechat_sign()` function in `src/Functions.php` unconditionally skips all signature verification when the PSR-7 request reports `localhost` as the host. An attacker can exploit this by sending a crafted HTTP request to the WeChat Pay callback endpoint with a `Host: localhost` header, bypassing the RSA signature check entirely. This allows forging fake WeChat Pay payment success notifications, potentially causing applications to mark orders as paid without actual payment. Version 3.7.20 fixes the issue.

GHSA-q938-ghwv-8gvc — WeChat Pay callback signature verification bypassed when Host header is localhost

Affected: Packagist: yansongda/pay

## Summary

The `verify_wechat_sign()` function in `src/Functions.php` unconditionally **skips all signature verification** when the PSR-7 request reports `localhost` as the host. An attacker can exploit this by sending a crafted HTTP request to the WeChat Pay callback endpoint with a `Host: localhost` header, bypassing the RSA signature check entirely.

This allows forging fake WeChat Pay payment success notifications, potentially causing applications to mark orders as paid without actual payment.

## Vulnerable Code

**`src/Functions.php` lines 243-246:** ```php function verify_wechat_sign(ResponseInterface|ServerRequestInterface $message, array $params): void { // BYPASS: Returns without any signature check if Host header is localhost if ($message instanceof ServerRequestInterface && 'localhost' === $message->getUri()->getHost()) { return; // No signature verified! }

// ... openssl_verify() only reached when Host != localhost $wechatSerial = $message->getHeaderLine('Wechatpay-Serial'); $sign = $message->getHeaderLine('Wechatpay-Signature'); $result = 1 === openssl_verify($content, base64_decode($sign), $public, 'sha256WithRSAEncryption'); } ```

In PSR-7 implementations (Nyholm, Guzzle PSR-7, etc.), `$request->getUri()->getHost()` reads the `Host` HTTP header, which is fully attacker-controlled.

## Proof of Concept

```bash curl -X POST https://merchant.example.com/payment/wechat/callback \ -H "Host: localhost" \ -H "Content-Type…

Most recent entries from all

EUVD-2026-277892

fkie_cve-2026-33661

GHSA-q938-ghwv-8gvc — WeChat Pay callback signature verification bypassed when Host header is localhost