{"id":"CVE-2026-54608","summary":"MythicalDash: Unauthenticated payment bypass in Stripe success-redirect endpoint allows arbitrary free credit top-up","details":"MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app/Api/System/Gateways/Stripe.php creates a pending row in mythicaldash_stripe_payments before Stripe checkout succeeds and embeds the payment code in the success redirect, while GET /api/stripe/processed accepts that code without constructing a Session, checking ownership, or retrieving the Stripe Checkout Session to require payment_status to be paid and amount_total to match the expected charge. An ordinary authenticated user can request an attacker-selected coins amount, abandon or fail payment, and submit the pending code directly to the unauthenticated processed endpoint. StripeDB::isPending() then permits User::addCreditsAtomic() to grant the unpaid amount and mark the row processed even though Stripe has not confirmed payment. This permits arbitrary free virtual-currency top-ups and direct financial loss through consumption of hosting resources. No fixed version is available as of this review.","aliases":["GHSA-qmh4-5v7g-42jq"],"modified":"2026-09-20T11:30:59.085072224Z","published":"2026-09-17T21:48:39.201Z","database_specific":{"cwe_ids":["CWE-345","CWE-862"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54608.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54608.json"},{"type":"ADVISORY","url":"https://github.com/MythicalLTD/MythicalDash/security/advisories/GHSA-qmh4-5v7g-42jq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54608"},{"type":"FIX","url":"https://github.com/MythicalLTD/MythicalDash/commit/188d4c4ed80b8d364b0c4605a9e38ceaab746e39"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mythicalltd/mythicaldash","events":[{"introduced":"0"},{"fixed":"188d4c4ed80b8d364b0c4605a9e38ceaab746e39"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"3.5.4-aurora"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["3.5.4-aurora","3.5.3-aurora","3.5.2-aurora","3.5.1-aurora","3.5.0-aurora-small","3.5.0-aurora","3.4.0-nexus","3.3.2-nexus","3.3.1-nexus","3.3.0-nexus","3.2.2-nexus","3.2.1-nexus","3.2.0-nexus","3.1.0-remastered","3.0.0.4-remastered","3.0.0.2-remastered","3.0.0.1-remastered","v3-remastered-1.0.0.1","v3-remastered-1.0.0","3.2.3","3.2.2","3.2.1","3.2.0","3.1.4","3.1.3","3.1.2","3.1.1","3.1.0","3.0.3.2","3.0.3.1","3.0.3","3.0.2pr","3.0.1","3.0.0","2.0.1","2.0.0","3.0.0.3-remastered","1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54608.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}]}