Our payment integration with Mollie did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.
Our payment integration with Mollie did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.
Why this VPI (explainable, experimental)
VPI breakdown
| Impact | 63.00 |
| Exploitation signal(No additional exploitation signal) | ×1.00 |
| VPI | 63.00 |
VPI formula vpi-v1