8 matches found
CVE-2026-54608
MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app/Api/System/Gateways/Stripe.php creates a pending row in mythicaldashstripepayments before Stripe checkout succeeds and embeds the payment code in the success redirect, while GET...
CVE-2026-54608
MythicalDash , a Pterodactyl client area, is affected in versions 3.5.4-aurora and earlier . The vulnerability resides in the Stripe payment flow : GET /api/stripe/process creates a pending database row and embeds the payment code in a success redirect, while GET /api/stripe/processed accepts tha...
CVE-2026-54608 MythicalDash: Unauthenticated payment bypass in Stripe success-redirect endpoint allows arbitrary free credit top-up
MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app/Api/System/Gateways/Stripe.php creates a pending row in mythicaldashstripepayments before Stripe checkout succeeds and embeds the payment code in the success redirect, while GET...
CVE-2026-54608
MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app/Api/System/Gateways/Stripe.php creates a pending row in mythicaldashstripepayments before Stripe checkout succeeds and embeds the payment code in the success redirect, while GET...
CVE-2026-54608 MythicalDash: Unauthenticated payment bypass in Stripe success-redirect endpoint allows arbitrary free credit top-up
MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app/Api/System/Gateways/Stripe.php creates a pending row in mythicaldashstripepayments before Stripe checkout succeeds and embeds the payment code in the success redirect, while GET...
EUVD-2026-82572
MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app/Api/System/Gateways/Stripe.php creates a pending row in mythicaldashstripepayments before Stripe checkout succeeds and embeds the payment code in the success redirect, while GET...
PT-2026-95143
Name of the Vulnerable Software and Affected Versions MythicalDash versions prior to 3.5.4-aurora Description An unauthenticated payment bypass exists in the Stripe success-redirect mechanism. The endpoint '/api/stripe/process' creates a pending payment record before checkout is completed and...
CVE-2026-54608: Insufficient Verification of Data Authenticity
MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app/Api/System/Gateways/Stripe.php creates a pending row in mythicaldashstripepayments before Stripe checkout succeeds and embeds the payment code in the success redirect, while GET...