The vulnerability stems from insufficient validation of payment status responses in the Oppwa integration of pretix. An attacker can take a successful payment status from one ticket transaction and feed it to the system for a different payment, causing the platform to believe the new transaction was successful and granting access to multiple valid tickets. This flaw has a CVSS score of 6.3 and is classified as CWE‑841, indicating poor validation of authentication credentials or responses.

The affected product is pretix’s Oppwa integration plugin. No specific version range is listed in the advisory, so any installation that has not been updated to the 2026‑5‑2 release may be vulnerable.

The risk is moderate. The CVSS score of 6.3 reflects that the flaw can be exploited remotely via the web interface or API, though the EPSS score is currently unavailable and the vulnerability is not listed in KEV. An attacker who can obtain or guess a valid payment status identifier could reuse it for another transaction, enabling unauthorized ticket issuance. The exploit requires no special privileges beyond the ability to submit a payment status update, making it potentially accessible to attackers who manipulate the payment callback or perform social engineering.