CVE-2026-111660— waynboot-mall through 2.0.0 Missing Authentication via /callback/order/unpaid
Quick assessment
Affected
wayn111 waynboot-mall
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
waynboot-mall 2.0.0 及更早版本存在认证缺失漏洞，允许未认证的攻击者通过 接口取消任意会员的待支付订单。攻击者可提交基于时间戳（epoch 秒）和顺序计数器构建的可预测订单编号（orderSn），从而自动取消未支付订单并操纵商品库存水平。
Possible ATT&CK Techniques 2 AI
T1203 · Exploitation for Client Execution T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| wayn111 | waynboot-mall | ≤ 2.0.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-111660
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
waynboot-mall through 2.0.0 Missing Authentication via /callback/order/unpaid
Source: CVE Program / CVE List V5
Vulnerability Description
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to auto-cancel unpaid orders and manipulate product stock levels.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| wayn111 | waynboot-mall | 0 ~ 2.0.0 | - |
|
II. Public POCs for CVE-2026-111660
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-111660
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-111660 (1)
Security Blog Posts for CVE-2026-111660 (1)
Other References for CVE-2026-111660 (1)
Same Patch Batch · wayn111 · 2026-10-16 · 3 CVEs total
| CVE-2026-111659 | 6.5 MEDIUM | Waynboot-mall through 2.0.0 Unauthenticated Order Forgery via /callback/order/submit |
| CVE-2026-111661 | 5.3 MEDIUM | waynboot-mall through 2.0.0 Missing Authentication via /callback/email Mail Endpoint |
IV. Related Vulnerabilities
Same product: waynboot-mall
-
CVE-2026-111661
waynboot-mall through 2.0.0 Missing Authentication via /call -
CVE-2026-111659
Waynboot-mall through 2.0.0 Unauthenticated Order Forgery vi -
CVE-2026-110127
waynboot-mall through 2.0.0 IDOR via Mobile Cart Endpoints -
CVE-2026-110126
waynboot-mall through 2.0.0 IDOR via Mobile Address Endpoint -
CVE-2026-110125
waynboot-mall through 2.0.0 IDOR via Mobile Order Endpoints
Same vendor: wayn111
-
CVE-2026-111661
waynboot-mall through 2.0.0 Missing Authentication via /call -
CVE-2026-111659
Waynboot-mall through 2.0.0 Unauthenticated Order Forgery vi -
CVE-2026-110127
waynboot-mall through 2.0.0 IDOR via Mobile Cart Endpoints -
CVE-2026-110126
waynboot-mall through 2.0.0 IDOR via Mobile Address Endpoint -
CVE-2026-110125
waynboot-mall through 2.0.0 IDOR via Mobile Order Endpoints
Same weakness: CWE-306
-
CVE-2026-111719
Roncoo-pay through commit 9428382 Information Disclosure via -
CVE-2026-111706
99AI through 4.3.0 Unauthenticated Information Disclosure vi -
CVE-2026-111704
LangChat through commit 2a6285a Missing Authentication on RE -
CVE-2026-111701
OtterMind Nubase through 0.1.4 Missing Authentication in Sto -
CVE-2026-111699
Niefy wx-api through 0.8.2 Authentication Bypass via Unverif
V. Comments for CVE-2026-111660
No comments yet