CVE-2026-107852

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-107852
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107852.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-107852
Aliases
  • GHSA-rf56-676w-hj4g
Published
2026-10-09T20:28:06Z
Modified
2026-10-10T10:45:15Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Jexactyl: Stripe checkout confirmation accepts mismatched-currency/amount payments as full payment (payment forgery)
Details

Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when payment_status is paid but does not compare amount_total or currency with the referenced order and configured billing currency. On an instance where the billing module is enabled and a Stripe secret key is configured, an authenticated client can therefore complete a lower-value or mismatched-currency payment and cause the order to be processed, provisioning, renewing, upgrading, or unsuspending the purchased server for less than the required price. This issue is fixed in version 4.0.5.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-345"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107852.json"
}
References

Affected packages

Git / github.com/jexactyl/jexactyl

Affected ranges

Type
GIT
Repo
https://github.com/jexactyl/jexactyl
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4bccd3d0eaf34d9db5255842d18340d08af90400
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.0.5"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v0.*
v0.1.0-beta
v0.1.1-beta
v0.1.2-beta
v0.2.0-beta
v0.3.0-beta
v0.4.0-beta
v0.4.1-beta
v0.5.0
v1.*
v1.0.0
v1.0.0-rc.1
v1.0.0-rc.3
v1.0.0-rc.4
v1.0.0-rc.5
v1.0.0-rc.6
v1.0.0-rc.7
v1.0.1
v1.0.2
v1.0.3
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.10.0
v1.10.1
v1.10.2
v1.10.3
v1.10.4
v1.11.0-rc.1
v1.11.0-rc.2
v1.2.0
v1.2.1
v1.2.2
v1.3.0
v1.3.1
v1.3.2
v1.4.0
v1.4.1
v1.4.2
v1.5.0
v1.5.1
v1.6.0
v1.6.1
v1.6.2
v1.6.3
v1.6.5
v1.6.6
v1.7.0
v1.8.0
v1.8.1
v1.9.0
v1.9.1
v1.9.2
v4.*
v4.0.0
v4.0.0-beta1
v4.0.0-beta2
v4.0.0-beta3
v4.0.0-beta4
v4.0.0-beta5
v4.0.0-beta6
v4.0.0-beta7
v4.0.0-rc1
v4.0.0-rc2
v4.0.0-rc3
v4.0.1
v4.0.2
v4.0.3
v4.0.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107852.json"