A critical authentication bypass vulnerability in the Yansongda Pay SDK allows unauthenticated attackers to spoof payment success notifications, potentially leading to significant financial loss.

This is an authentication bypass by spoofing (CWE-290) occurring in the verify_wechat_sign function. An unauthenticated attacker can manipulate the Host header to localhost, forcing the SDK to skip signature verification and accept fraudulent payment callbacks.

The ability to forge payment success notifications presents a severe risk of direct financial loss and inventory depletion for any organization relying on this SDK for payment processing. With a CVSS score of 8.6, this vulnerability is categorized as High, reflecting the ease of exploitation and the significant impact on data integrity regarding transaction status.

Immediate Action: Update the yansongda/pay package to version 3.7.20 or later via your dependency manager immediately.

Proactive Monitoring: Review web server access logs for anomalous callback requests to the payment endpoint, specifically checking for requests where the Host header is set to localhost.

Compensating Controls: Implement strict firewall rules to ensure that payment callback endpoints only accept traffic from verified IP ranges belonging to the payment provider.

Public Exploit Available: Unknown.

Given the potential for direct financial impact, organizations using the Yansongda Pay SDK must prioritize the transition to version 3.7.20. While no active exploitation has been confirmed, the availability of a proof-of-concept necessitates immediate action to prevent malicious actors from abusing the signature verification bypass to manipulate transaction states.