CVE-2026-86405: Sipay PrestaShop Auth Bypass Vulnerability

CVE-2026-86405 Overview

CVE-2026-86405 is a critical cryptographic signature verification flaw in the Sipay PrestaShop Virtual POS Module. The module processes payment callbacks for PrestaShop e-commerce stores integrated with Sipay Electronic Money and Payment Services. Improper validation of cryptographic signatures allows an unauthenticated attacker to spoof signed messages over the network. The flaw is classified under [CWE-347: Improper Verification of Cryptographic Signature]. Affected versions span from 26.8.1 up to but not including 26.9.1. The vulnerability is network-exploitable without privileges or user interaction, exposing confidentiality, integrity, and availability of payment transaction data.

Critical Impact
An unauthenticated remote attacker can forge payment callbacks or administrative messages by bypassing signature validation, enabling transaction manipulation and merchant financial loss.

Affected Products

Sipay PrestaShop Virtual POS Module version 26.8.1
Sipay PrestaShop Virtual POS Module versions after 26.8.1 and before 26.9.1
PrestaShop merchant storefronts integrating the Sipay Virtual POS payment module

Discovery Timeline

2026-10-09 - CVE-2026-86405 published to the National Vulnerability Database
2026-10-12 - Last updated in NVD database

Technical Details for CVE-2026-86405

Vulnerability Analysis

The Sipay PrestaShop Virtual POS Module integrates Sipay payment processing into PrestaShop checkout flows. The module relies on cryptographic signatures to authenticate payment responses and callbacks returned from the payment gateway. The affected code path performs signature verification in a way that fails to properly reject forged or tampered signatures. An attacker who crafts a payment notification with a spoofed signature can have it accepted by the module as legitimate. This undermines the integrity guarantees that signature verification is intended to enforce for financial transactions.

Root Cause

The root cause is improper validation logic within the signature verification routine, categorized under [CWE-347]. Signature verification routines in payment modules typically compare a computed hash-based message authentication code (HMAC) or digital signature against a value supplied by the caller. When the comparison or canonicalization step is incorrect, attacker-controlled signatures can satisfy the check. The vendor advisory published by Türkiye's national cyber security authority confirms the module permits signature spoofing by improper validation. Technical specifics are documented in the Siber Güvenlik Notification TR-26-1287.

Attack Vector

Exploitation requires only network access to the merchant's PrestaShop endpoint that receives Sipay payment callbacks. The attacker sends a crafted HTTP request to the Sipay callback or notification URL exposed by the module. The request contains manipulated transaction parameters along with a forged signature value. Because the module accepts the spoofed signature as valid, it processes the fraudulent payment event. Downstream effects include marking unpaid orders as paid, altering transaction amounts, or triggering administrative state changes.

No verified exploit code is publicly available. For additional technical details, consult the Siber Güvenlik advisory TR-26-1287.

Detection Methods for CVE-2026-86405

Indicators of Compromise

Unexpected PrestaShop order state transitions to paid or completed without a corresponding authorized Sipay transaction ID in merchant reconciliation records.
HTTP POST requests to the Sipay callback endpoint originating from IP addresses that do not match Sipay's documented gateway infrastructure.
Discrepancies between the amount recorded on PrestaShop orders and the amount settled by the Sipay payment gateway.
Repeated callback requests with identical or malformed hash_key or signature parameters outside normal transaction patterns.

Detection Strategies

Enable verbose logging on the PrestaShop Sipay module to capture every inbound callback with full payload, source IP, and signature verification outcome.
Reconcile every PrestaShop order marked paid against the Sipay merchant dashboard daily to surface orders without a matching gateway settlement.
Alert on PrestaShop order status changes triggered by callbacks that lack a prior customer checkout session in web server logs.

Monitoring Recommendations

Forward PrestaShop application logs and web server access logs to a centralized log analytics platform for correlation and retention.
Monitor the Sipay payment module directory for unauthorized file modifications and track module version strings across all merchant hosts.
Track outbound notifications sent to administrators and customers for anomalies in order confirmation volume that may indicate automated callback abuse.

How to Mitigate CVE-2026-86405

Immediate Actions Required

Upgrade the Sipay PrestaShop Virtual POS Module to version 26.9.1 or later on every affected PrestaShop installation.
Audit all orders processed since the deployment of a vulnerable module version against Sipay gateway settlement records and refund or cancel fraudulent orders.
Rotate the Sipay merchant API credentials and signing keys configured within the module after upgrading.
Restrict inbound access to the Sipay callback URL to Sipay's published gateway IP ranges at the web application firewall or reverse proxy layer.

Patch Information

The vendor fixed the signature verification logic in Sipay PrestaShop Virtual POS Module version 26.9.1. Administrators running any release in the range from 26.8.1 up to but not including 26.9.1 must upgrade. Refer to the Siber Güvenlik Notification TR-26-1287 for vendor coordination details and release references.

Workarounds

Temporarily disable the Sipay Virtual POS Module in PrestaShop and route checkout through an alternative payment provider until the patch is applied.
Place a web application firewall rule in front of the Sipay callback endpoint that enforces source IP allow-listing to Sipay's gateway infrastructure.
Require manual merchant review and approval of all orders paid through the Sipay module before fulfillment while the vulnerable module remains in use.

bash

# Example nginx allow-list restricting Sipay callback endpoint to gateway IPs
location /modules/sipaypayment/validation.php {
    allow 185.233.0.0/16;   # replace with Sipay-published gateway ranges
    deny all;
    proxy_pass http://prestashop_backend;
}