IBM Safer Payments versions 6.4.0.00 through 6.8.0.00 contain an improper input validation flaw that allows an authenticated user to decode and retrieve sensitive information using a series of API calls. The vulnerability enables the attacker to access data that should be protected, leading to potential exposure of confidential payment information. This weakness is mapped to CWE-1287, indicating improper handling of signed or unsigned values during decryption.

The affected products are IBM Safer Payments builds 6.4.0.00–6.4.2.11, 6.5.0.00–6.5.0.09, 6.6.0.00–6.6.0.07, 6.7.0.00–6.7.0.03, and 6.8.0.00. Any deployment of these versions is vulnerable until patched to a later release such as 6.4.2.12, 6.5.0.10, 6.6.0.08, 6.7.0.04, or 6.8.0.01 or newer.

The CVSS score of 5.3 indicates a moderate severity vulnerability. The EPSS score is unavailable, and the issue is not listed in the CISA KEV catalog, suggesting that known public exploits are not yet documented. Exploitation requires a valid authenticated session and access to the relevant API endpoints, which may limit the pool of potential attackers to internal users or compromised accounts. Nonetheless, the possibility of sensitive data exposure warrants immediate attention.