H3-2026-1140¶
Casbin Casdoor GC Payment Provider Signature Verification Bypass Vulnerability
| Category | VULNERABILITY |
| Base Score | 7.5 |
Description¶
Casbin Casdoor's GC payment provider notification handler does not verify the signature on incoming payment notifications before processing them. The handler decodes the base64 encoded data field of a notification into application fields and updates the corresponding order and payment state without checking that the accompanying sign value was produced with the provider's shared secret key. Remote attackers who know or can enumerate a payment's identifier can post a forged notification directly to the public callback endpoint and have it accepted as genuine.
Impact¶
Remote attackers can mark arbitrary orders as paid without making any real payment, obtaining paid products, services, or account entitlements for free. Operators relying on Casdoor's built in GC payment integration for monetized access face direct financial loss and inventory or entitlement records that no longer reflect actual payments received.