CVE-2025-29788: Sylius PayPal Plugin Auth Bypass Flaw

CVE-2025-29788 Overview

CVE-2025-29788 is a business logic vulnerability in the Sylius PayPal Plugin, the Sylius Core Team's integration for the PayPal Commerce Platform. The flaw affects versions prior to 1.6.1, 1.7.1, and 2.0.1. Attackers can manipulate the final payment amount processed by PayPal by modifying the cart quantity after initiating the PayPal Express Checkout flow. PayPal captures only the initial amount, while Sylius marks the order fully paid based on the modified higher total. The weakness maps to [CWE-472: External Control of Assumed-Immutable Web Parameter].

Critical Impact
Attackers can intentionally pay less than the actual order total, causing direct financial losses to merchants and compromising the integrity of payment processing.

Affected Products

Sylius PayPal Plugin versions prior to 1.6.1 (1.6.x branch)
Sylius PayPal Plugin versions prior to 1.7.1 (1.7.x branch)
Sylius PayPal Plugin versions prior to 2.0.1 (2.0.x branch)

Discovery Timeline

2025-03-17 - CVE-2025-29788 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-29788

Vulnerability Analysis

The vulnerability exists in the payment processing workflow of the Sylius PayPal Plugin. When a customer initiates the PayPal Express Checkout, the plugin transmits the current cart total to PayPal. However, the plugin does not re-verify this amount against the current order total when the payment is captured. If the user increases the item quantity in the cart between initiation and capture, PayPal still charges the initial lower amount. Sylius then completes the order using the newer, higher total as the reference for payment status. The result is an underpaid order that the platform considers fully settled.

Root Cause

The root cause is missing server-side reconciliation between the amount authorized by PayPal and the current order total at capture time. The affected controllers, ProcessPayPalOrderAction, CompletePayPalOrderFromPaymentPageAction, and the CaptureAction, trusted the assumed-immutable payment amount without validating that the order total remained unchanged. This is a classic instance of [CWE-472], where a server treats a client-influenced value as authoritative without independent verification.

Attack Vector

The attack requires user interaction and network access to the storefront but no authentication. An attacker adds items to the cart, proceeds to PayPal Express Checkout to lock in a low total, then returns to the store and increases cart quantities before completing payment. PayPal captures the original lower amount, while Sylius records the order as paid in full at the higher amount.

php

// Security patch from Sylius/PayPalPlugin commit 31e71b0457e5d887a6c19f8cfabb8b16125ec406
// File: src/Controller/ProcessPayPalOrderAction.php
 use Sylius\Component\Resource\Factory\FactoryInterface;
 use Sylius\PayPalPlugin\Api\CacheAuthorizeClientApiInterface;
 use Sylius\PayPalPlugin\Api\OrderDetailsApiInterface;
+use Sylius\PayPalPlugin\Exception\PaymentAmountMismatchException;
 use Sylius\PayPalPlugin\Manager\PaymentStateManagerInterface;
 use Sylius\PayPalPlugin\Provider\OrderProviderInterface;
+use Sylius\PayPalPlugin\Verifier\PaymentAmountVerifierInterface;
 use Symfony\Component\HttpFoundation\JsonResponse;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;

// The patch introduces PaymentAmountVerifierInterface and PaymentAmountMismatchException
// to reconcile the PayPal amount with the current order total before capture.
// Source: https://github.com/Sylius/PayPalPlugin/commit/31e71b0457e5d887a6c19f8cfabb8b16125ec406

Detection Methods for CVE-2025-29788

Indicators of Compromise

Sylius orders marked as paid where the PayPal capture amount is lower than the recorded order total.
Customer sessions where the PayPal Express Checkout was initiated, then the cart contents were modified before completion.
Multiple PATCH or update requests to the cart endpoint occurring between the PayPal create-order and capture API calls.

Detection Strategies

Reconcile PayPal transaction reports against the Sylius order ledger and flag any order where captured amount differs from recorded total.
Instrument application logs to record the transmitted PayPal amount at checkout initiation and compare against the final order total at capture.
Review HTTP access logs for patterns of cart modification requests occurring after /paypal/complete or PayPal redirect callbacks.

Monitoring Recommendations

Enable structured logging in the PayPal plugin controllers, ProcessPayPalOrderAction and CompletePayPalOrderFromPaymentPageAction, to capture both amounts.
Configure alerts in your finance or fraud monitoring system for payment shortfalls beyond a defined threshold.
Schedule daily reconciliation jobs comparing PayPal Commerce Platform settlement data to Sylius order totals.

How to Mitigate CVE-2025-29788

Immediate Actions Required

Upgrade the Sylius PayPal Plugin to version 1.6.1, 1.7.1, or 2.0.1 depending on your branch.
Audit historical orders processed via PayPal Express Checkout for amount mismatches and initiate chargebacks or corrections where appropriate.
Temporarily disable PayPal Express Checkout on affected storefronts until the patch is applied if audit findings indicate active exploitation.

Patch Information

The issue is fixed in Sylius PayPal Plugin releases v1.6.1, v1.7.1, and v2.0.1. The fix introduces a PaymentAmountVerifierInterface and PaymentAmountMismatchException to validate that the amount authorized by PayPal matches the current order total before capture. See the GitHub Security Advisory GHSA-pqq3-q84h-pj6x and the corresponding patch commit for implementation details.

Workarounds

Override ProcessPayPalOrderAction, CompletePayPalOrderFromPaymentPageAction, and CaptureAction in the end application with logic that verifies the PayPal transaction amount against the current order total before marking payment as complete.
Reject and re-authorize any PayPal transaction where the captured amount does not equal the current order total.
Lock cart contents once PayPal Express Checkout has been initiated, preventing quantity or item changes until the flow completes or is abandoned.

bash

# Update the plugin via Composer to the patched version matching your branch
composer require sylius/paypal-plugin:^2.0.1
# or for the 1.7.x branch
composer require sylius/paypal-plugin:^1.7.1
# or for the 1.6.x branch
composer require sylius/paypal-plugin:^1.6.1

# Clear the Symfony cache after the update
bin/console cache:clear --env=prod