The vulnerability arises from improper input validation in the transaction API of CediPay, classified as CWE-20. Attackers can bypass the API’s checks and send crafted transaction requests that are accepted by the application. Based on the description, it is inferred that this can allow the creation of unauthorized transfers of cryptocurrency to fiat, modification of transaction amounts, or execution of fraudulent operations that lead to financial loss.

CediPay, developed by XpertForexTradeInc., is affected in all releases prior to version 1.2.3. The fix is implemented in version 1.2.3 and all subsequent releases are presumed patched.

The CVSS base score of 8.8 indicates a high severity flaw, while the EPSS score of <1% implies a very low likelihood of exploitation at the time of evaluation. The vulnerability is not listed in the CISA KEV catalog. Likely attack vectors involve an attacker who can reach the transaction API endpoint—either publicly exposed or within a trusted network—constructing malicious payloads to circumvent the missing validation. Though the probability of exploitation remains low, the potential for significant fraudulent activity and financial loss makes the risk substantial.