CVE-2026-107852

Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when paymentstatus is paid but does not compare amounttotal or currency with the referenced order and...

CVE-2026-107852 Jexactyl: Stripe checkout confirmation accepts mismatched-currency/amount payments as full payment (payment forgery)

Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when paymentstatus is paid but does not compare amounttotal or currency with the referenced order and...

CVE-2026-107852

In Jexactyl (a game management and billing system), a vulnerability exists prior to version 4.0.5 in the POST /api/client/billing/stripe/process endpoint. The system fails to verify if the amount_total or currency of a client-supplied Stripe Checkout Session matches the referenced order's require...