The pretix-oppwa plugin constructs a URL by concatenating the resourcePath value supplied by the Oppwa payment provider with a configured base API URL without validating the path or restricting the domain. Because the redirect URL can be influenced by an attacker, a crafted resourcePath can point to an arbitrary host. The resulting server‑side request includes the Oppwa API access token that the plugin transmits in the outgoing request, causing a Server‑Side Request Forgery that not only allows arbitrary HTTP calls but also leaks credentials. This gives the attacker read access to transaction data in the payment provider’s system, representing a critical privacy breach and potential entry point for further compromise. The vulnerability is a classic example of Improper Input Validation (CWE‑20) and represents an SSRF flaw (CWE‑918). The plugin did not enforce a leading slash or domain check, which allowed the attacker to subvert the intended API endpoint. Successful exploitation would expose the Oppwa access token and any payment data retrievable through that token, effectively bypassing any client‑side authentication mechanisms and enabling the attacker to read or potentially modify payment information.

All sites running the pretix-oppwa plugin before the 2026‑5‑3 release are affected. The vulnerable logic existed in every earlier release of the plugin for the pretix e‑commerce platform, and the 2026‑5‑3 update replaces the insecure concatenation with strict URL validation.

The flaw has a CVSS score of 9, indicating critical severity, and an EPSS score of less than 1 %, showing a low but non‑zero likelihood of exploitation in the wild. It is not listed in CISA’s KEV catalog currently. The attack vector requires an attacker able to influence the redirect URL that the payment provider sends back to pretix; by supplying a crafted resourcePath, the attacker can force pretix to perform a server‑side request to an arbitrary host and leak the Oppwa API token. Successful exploitation would grant read access to payment transaction data in the provider’s system.