CVE-2026-18029

This CVE describes a transaction binding failure, not a simple payment validation gap. The attacker doesn't need to forge a payment response—they observe a legitimate success response for Payment A and submit it against Payment B. The system checks 'did this payment succeed?' without checking 'did this payment succeed for THIS payment ID?' That's the actual vulnerability: a broken object-level binding rather than a cryptographic or input validation flaw. The CVSS 6.3 rating materially understates the business risk. The technical impact metrics treat this as partial authorization compromise with moderate availability impact. But the actual impact is issuance of multiple valid tickets without payment—a direct financial loss. The economic asymmetry is critical: the marginal cost of each additional unauthorized ticket is zero. One successful substitution attack can yield unlimited tickets. CVSS measures technical dimensions, not business risk, and this gap is especially severe for authorization flaws in payment-critical paths. When evaluating the remediation, the critical question is not whether replay prevention was added, but whether the payment response is cryptographically bound to the specific payment intent. A proper fix requires HMAC-signed responses with embedded payment references that the server validates before issuing tickets. Adding timestamps and nonces prevents replay of the same response—but it does not prevent substitution, where a valid response for one transaction is pointed at a different transaction ID. If the fix only addresses replay, the binding failure persists. This pattern is not unique. At least eleven CVEs since 2014 across payment processors, OAuth callbacks, and webhook handlers have exhibited this same transaction-identity assertion failure. In every documented case, the fix was replay prevention. In every case, the binding check was absent. Test suites for these fixes typically validate 'can I reuse this response twice?' but not 'can I take this response and submit it against a different transaction ID?' That test design reproduces the original vulnerability at verification time. For CVE-2026-18029, verify that the remediation includes server-side validation that the payment response corresponds to the specific payment intent that initiated it—not just that the response hasn't been replayed. If the fix is limited to nonce or timestamp checks, treat it as incomplete regardless of the CVSS rating.

Reviewed through automated stages and approved by a human before publication.