Description
The payment integration pretix-oppwa provides support
for the payment providers VR Payment, Hobex, and potentially others
based on Oppwa's technology. The integration of Oppwa, following their
official documentation, includes a step where the user is redirected
from the payment provider back to our system with a query parameter like
?resourcePath=/v1/checkouts/{checkoutId}/payment in the URL. Our system is then supposed to fetch the status of the transaction from the URL given by baseUrl + resourcePath.



Our plugin pretix-oppwa did so insecurely by
concatenating the parameter form the URL to the base domain of the API
without further validation and, critically, without a / at the end of the baseUrl. Therefore, an attacker could inject a resourcePath argument in a way that causes pretix to call a different
server instead. Since the request includes the access token (API key)
of the Oppwa account, this would leak the access token, giving access to
data contained in the payment provider's system. This is fixed with the
release today by strictly validating the given API URL.









After installing the update, we recommend asking your payment provider for a new access token and updating it in pretix.
Published: 2026-07-01
Score: 9 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The pretix-oppwa plugin builds a request URL by concatenating a resourcePath supplied by the payment provider directly onto a base API URL, without validation or normalization. This input validation weakness (CWE-20) enables an attacker to craft a redirect URL that causes pretix to perform a server‑side request to an arbitrary host. Because each request includes the payment provider’s access token, the leak exposes this credential, granting the attacker read access to sensitive payment data. This flaw constitutes an SSRF vulnerability (CWE-918) that can lead to unauthorized disclosure of confidential financial information.

Affected Systems

Any installation of the pretix-oppwa plugin for the pretix e‑commerce platform that has not been updated to the 2026‑5‑3 release or later is affected. The exact affected versions are not listed, but all releases before the latest contain the vulnerable concatenation logic. Administrators using pretix with the plugin should verify the plugin version and update accordingly.

Risk and Exploitability

The vulnerability scores a CVSS of 9, indicating critical severity. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector involves the payment provider’s redirect URI that an attacker can influence. Successful exploitation would expose the Oppwa API token and any payment data accessible through it.

Generated by OpenCVE AI on July 2, 2026 at 16:14 UTC.

Remediation

Vendor Solution

After installing the update, we recommend asking your payment provider for a new access token and updating it in pretix.Attack detection: If you have access logs, you can search them for resourcePath= not followed by a / or encoded slash %2F.

Vendor Workaround

Workaround: If you are unable to update pretix quickly, we still recommend to try installing the pretix-oppwa plugin in the latest version. We have not tested it with every old pretix release, but we expect it to be compatible with any version after 2025.1. Otherwise, we recommend to uninstall the pretix-oppwa plugin.

OpenCVE Recommended Actions

  • Update the pretix-oppwa plugin to the 2026‑5‑3 release or later. After installing the update, obtain a new Oppwa API token from your payment provider and configure the new token in pretix.
  • If an immediate update is not possible, install the next available plugin release that is compatible with pretix releases after 2025.1; this mitigates the risk while awaiting a full upgrade. Alternatively, uninstall the plugin until a patched version becomes available.
  • Restrict outbound HTTP(S) traffic from the Pretix server to only authorized endpoints, such as the official Oppwa API domain, using firewall or network controls to prevent unintended SSRF requests.

Generated by OpenCVE AI on July 2, 2026 at 16:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 01 Jul 2026 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Pretix
Pretix pretix-oppwa
Vendors & Products Pretix
Pretix pretix-oppwa

Wed, 01 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 13:45:00 +0000

Type Values Removed Values Added
Description The payment integration pretix-oppwa provides support for the payment providers VR Payment, Hobex, and potentially others based on Oppwa's technology. The integration of Oppwa, following their official documentation, includes a step where the user is redirected from the payment provider back to our system with a query parameter like ?resourcePath=/v1/checkouts/{checkoutId}/payment in the URL. Our system is then supposed to fetch the status of the transaction from the URL given by baseUrl + resourcePath. Our plugin pretix-oppwa did so insecurely by concatenating the parameter form the URL to the base domain of the API without further validation and, critically, without a / at the end of the baseUrl. Therefore, an attacker could inject a resourcePath argument in a way that causes pretix to call a different server instead. Since the request includes the access token (API key) of the Oppwa account, this would leak the access token, giving access to data contained in the payment provider's system. This is fixed with the release today by strictly validating the given API URL. After installing the update, we recommend asking your payment provider for a new access token and updating it in pretix.
Title SSRF with API key leak in pretix-oppwa
Weaknesses CWE-20
CWE-918
References
Metrics cvssV4_0

{'score': 9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:U'}

Subscriptions

Pretix Pretix-oppwa
cve-icon MITRE

Status: PUBLISHED

Assigner: rami.io

Published:

Updated: 2026-07-01T14:07:36.332Z

Reserved: 2026-06-29T08:26:51.607Z

Link: CVE-2026-13603

cve-icon Vulnrichment

Updated: 2026-07-01T14:07:32.426Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-02T16:15:03Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-918

    Server-Side Request Forgery (SSRF)