CVE-2026-13603 Overview
CVE-2026-13603 affects pretix-oppwa, a payment integration plugin that supports VR Payment, Hobex, and other providers built on Oppwa's technology. The plugin concatenated an attacker-controllable resourcePath query parameter to the payment API base domain without validation and without a trailing / on the baseUrl. An attacker can inject a crafted resourcePath value that redirects pretix's outbound request to an attacker-controlled server. Because the outbound request includes the Oppwa account access token, exploitation leaks the API key and grants access to data stored in the payment provider's system. The issue is tracked as an improper input validation weakness [CWE-20].
Critical Impact
Attackers can exfiltrate Oppwa payment provider API access tokens by manipulating the resourcePath return parameter, exposing customer payment data.
Affected Products
- pretix-oppwa payment integration plugin (versions prior to the 2026-5-3 release)
- pretix deployments using VR Payment via pretix-oppwa
- pretix deployments using Hobex or other Oppwa-based providers via pretix-oppwa
Discovery Timeline
- 2026-07-01 - CVE-2026-13603 published to NVD
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-13603
Vulnerability Analysis
The Oppwa payment flow redirects the user back to pretix with a query parameter of the form ?resourcePath=/v1/checkouts/{checkoutId}/payment. The plugin then fetches the transaction status from a URL constructed as baseUrl + resourcePath. The outbound HTTP request carries the Oppwa access token used to authenticate against the payment provider API.
The plugin did not validate the incoming resourcePath value and did not enforce a trailing / on baseUrl. String concatenation without host validation lets an attacker change the effective host of the outbound request. Any server the attacker controls receives the request, including the Authorization header carrying the API key.
A leaked Oppwa access token grants read access to payment records, customer transaction data, and other information exposed by the payment provider API. The confidentiality and integrity impact extend beyond pretix into the connected merchant account.
Root Cause
The root cause is improper input validation [CWE-20] in URL construction. Because baseUrl lacked a trailing / and the appended resourcePath was not restricted to a safe path, an attacker-supplied value such as .attacker.example/v1/checkouts/x/payment alters the target authority of the resulting URL rather than appending a path to the intended host.
Attack Vector
Exploitation is remote and unauthenticated. An attacker initiates or influences a payment flow so that the redirect back to pretix carries a crafted resourcePath query parameter. When pretix processes the callback, it issues an authenticated outbound request to the attacker-chosen server. The attacker captures the Oppwa API key from the request and reuses it against the payment provider's API.
No verified exploit code is publicly available. See the Pretix Blog Release Notes for the vendor description of the flaw and fix.
Detection Methods for CVE-2026-13603
Indicators of Compromise
- Outbound HTTP requests from pretix hosts to domains other than the configured Oppwa baseUrl shortly after a payment callback.
- Payment callback URLs containing resourcePath values that include characters altering the target host, such as leading ., //, or additional dots before the expected /v1/checkouts/ path.
- Unexpected use of the Oppwa API key from IP addresses that do not match the pretix deployment.
Detection Strategies
- Inspect web server access logs for resourcePath query parameters that do not begin with a strict /v1/checkouts/ prefix followed by a checkout identifier.
- Correlate pretix egress traffic with the configured payment provider hostnames and alert on deviations.
- Review payment provider audit logs for API key usage originating outside of expected pretix source addresses.
Monitoring Recommendations
- Log and retain all outbound HTTP requests initiated by the pretix worker processes, including destination host and TLS SNI.
- Enable payment provider access logs and alert on API key use from new IP addresses or user agents.
- Track pretix plugin versions across deployments to confirm the patched release of pretix-oppwa is installed.
How to Mitigate CVE-2026-13603
Immediate Actions Required
- Upgrade pretix-oppwa to the fixed release announced in the pretix 2026-5-3 update.
- Rotate the Oppwa access token by requesting a new key from the payment provider and updating it in pretix, as recommended by the vendor.
- Review payment provider audit logs for unauthorized API activity using the previous token.
Patch Information
The pretix maintainers fixed the flaw by strictly validating the API URL derived from baseUrl + resourcePath before issuing the outbound request. Details are published in the Pretix Blog Release Notes. Operators must both apply the update and rotate the Oppwa API key, because tokens may have been exposed prior to the patch.
Workarounds
- Restrict egress from pretix workers to the specific hostnames of configured payment providers using a firewall or forward proxy allowlist.
- Temporarily disable the pretix-oppwa plugin until the patched version is deployed and the API key has been rotated.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
