The pretix‑oppwa plugin builds a request URL by concatenating a resourcePath value supplied by the payment provider with a configured base API URL. It does this without validating the path or enforcing a trailing slash, which allows a malicious attacker to supply a resourcePath that points to any host. This flaw results in a server‑side request to an unintended destination while the request still carries the Oppwa API access token embedded by the plugin, leaking the credential and exposing all payment data retrievable through that token. The vulnerability is an example of Improper Input Validation and a classic SSRF flaw, providing read access to transaction data and potentially enabling further compromise.

All pretix installations that use the pretix‑oppwa plugin and that have not applied the 2026‑5‑3 update are affected. The issue exists in every previous release of the plugin for the pretix e‑commerce platform. Versions predating the 2026‑5‑3 release, regardless of the pretix core version, are vulnerable.

The flaw carries a CVSS score of 9, indicating critical severity, and an EPSS score of less than 1 %, indicating a low but non-zero likelihood of exploitation in the wild. It is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector requires an attacker capable of influencing the redirect URL that the payment provider sends back to pretix; by tampering with the resourcePath query parameter, the attacker can force pretix to perform an arbitrary outbound request, retrieving the embedded API token. If exploited, the attacker gains read access to the payment provider’s system and any data obtainable through the compromised token.