An open‑source payment SDK for Chinese payment services contains a flaw in the signature verification routine that skips all checks when the HTTP Host header is set to localhost. An attacker who can send a crafted request to the WeChat Pay callback endpoint with a Host: localhost header can bypass the RSA signature verification entirely, allowing the attacker to forge a payment success notification and cause an application to record an order as paid without any real transaction.

The vulnerability affects any installation of the yansongda Pay SDK older than version 3.7.20. When this library exposes a WeChat Pay callback endpoint to external traffic, the skip logic can be triggered by a simple HTTP header manipulation.

With a CVSS score of 8.6 the flaw is considered high severity, yet its EPSS score is under 1% and it is not listed in the CISA KEV catalog, indicating low current exploitation likelihood. The attack vector is network‑based, requiring only a single crafted HTTP request. Because the bypass depends solely on the Host header, it can be performed remotely without escalating privileges, but the impact is the potential to manipulate financial transactions.