CVE-2026-105218 gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client

gopay before 1.5.119 disables TLS certificate verification in defaultClient in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and transaction data, and modify payment,...

CVE-2026-105218

Versions of gopay prior to 1.5.119 are vulnerable to a Man-in-the-Middle (MitM) attack due to disabled TLS certificate verification within the defaultClient() function in pkg/xhttp/client.go. An attacker can intercept communications by presenting any certificate to read sensitive merchant credent...

CVE-2026-105218 gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client

gopay before 1.5.119 disables TLS certificate verification in defaultClient in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and transaction data, and modify payment,...