CVE-2026-13602 Overview
CVE-2026-13602 describes a vulnerability chain in the Pretix ticketing platform that allows an authenticated backend user to impersonate any other user, including administrators. The chain combines three weaknesses across payment integration plugins and core system features. It affects the Stripe integration bundled with the core system, along with the pretix-mollie, pretix-oppwa, pretix-bitpay, pretix-payone, pretix-secuconnect, pretix-sofort, and pretix-saferpay plugins. The root weakness is classified as [CWE-20] Improper Input Validation.
Critical Impact
An attacker with access to at least one event in the backend can inject arbitrary session parameters, switch identities to any user, and access any data in the Pretix instance.
Affected Products
- Pretix core system (including bundled Stripe payment integration)
- Pretix payment plugins: pretix-mollie, pretix-oppwa, pretix-bitpay, pretix-payone
- Pretix payment plugins: pretix-secuconnect, pretix-sofort, pretix-saferpay
Discovery Timeline
- 2026-07-01 - CVE-2026-13602 published to NVD
- 2026-07-01 - Vendor releases patched builds (Pretix 2026.5.3 and updated plugins)
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-13602
Vulnerability Analysis
The vulnerability chain exploits three independent features that, when combined, produce a full backend account takeover primitive. First, the payment plugins accept cryptographically signed session parameters passed through URL parameters, a mechanism designed to move session context from an isolated widget tab into a new tab. The plugins verify the signature but do not restrict which session parameters may be set. Any signed key/value pair is accepted and applied to the user session.
Second, an unrelated Referer-stripping redirect feature in the core system uses the same signing key and salt as the payment plugin transport. This allows an attacker with backend access to any event to craft a redirect link, receive a valid signature over attacker-controlled content, and reuse that signature against the payment plugin endpoint.
Third, the core system exposes an administrative impersonation feature intended for debugging. Once an attacker can inject arbitrary session parameters through the previous two flaws, they can set the impersonation state and switch their session to any user in the system by guessing a valid user ID.
Root Cause
The underlying defect is [CWE-20] Improper Input Validation. Signed parameters are trusted based on signature validity alone. The signing scheme also reuses a single key and salt across unrelated features, violating cryptographic domain separation. The impersonation feature further trusts guessable identifiers rather than requiring unguessable session state.
Attack Vector
An authenticated attacker with access to a single backend event abuses the redirect feature to obtain a signature over crafted parameters. They pass those parameters to a payment plugin endpoint, which applies them to their session. The attacker then invokes the admin impersonation logic with a target user ID and takes over that account.
No verified public exploit code is available. Refer to the Pretix Blog Release Announcement for the vendor's technical description.
Detection Methods for CVE-2026-13602
Indicators of Compromise
- Unexpected requests to payment plugin return URLs containing signed session parameters that reference fields outside the plugin's own scope.
- Requests to the core Referer-stripping redirect endpoint from backend user sessions with unusual or non-outbound target parameters.
- Backend audit log entries showing user impersonation events initiated by non-admin accounts or targeting high-privilege user IDs.
Detection Strategies
- Review Pretix application logs for backend sessions whose active user identifier changes without a corresponding legitimate admin su-style action.
- Correlate signed URL parameter usage across payment plugin endpoints and the Referer redirect endpoint from the same source IP or session.
- Alert on backend accounts accessing events, orders, or organizers outside their normal permission scope after a session parameter change.
Monitoring Recommendations
- Enable and centralize Pretix web server access logs and Django application logs in a SIEM for long-term retention.
- Baseline normal use of the impersonation feature and alert on deviations, particularly non-admin invocations.
- Monitor for outbound HTTP requests generated by the Referer-stripping redirect that carry signed payloads not aligned with normal user-facing links.
How to Mitigate CVE-2026-13602
Immediate Actions Required
- Upgrade Pretix core to the release published on 2026-07-01 and update all listed payment plugins to their patched versions.
- Audit backend user accounts, remove unused organizer/event access, and rotate credentials for any users suspected of compromise.
- Review recent impersonation events and administrative actions for signs of unauthorized identity switching.
Patch Information
The vendor fixed the chain by strictly validating that payment plugins only accept session parameters within their own scope, by assigning distinct salts to each plugin and feature to prevent signature reuse, and by requiring unguessable information in the target session for the impersonation feature. See the Pretix Blog Release Announcement for version-specific details.
Workarounds
- If patching cannot be performed immediately, disable non-essential payment plugins from the affected list until updates are applied.
- Restrict backend access to trusted operators and enforce multi-factor authentication on all Pretix backend accounts.
- Invalidate active backend sessions after upgrading to ensure no pre-existing tampered session parameters persist.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
