Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-54608— MythicalDash: Unauthenticated payment bypass in Stripe success-redirect endpoint allows arbitrary free credit top-up

Quick assessment

Affected
MythicalLTD MythicalDash
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MythicalDash 是一个 Pterodactyl 客户端管理面板。在 3.5.4-aurora 及更早版本中，后端文件 中的 会在 Stripe 结账成功之前，先在 表中创建一条状态为“待处理”（pending）的记录，并将支付码嵌入到成功重定向链接中。而 接口在接收该支付码时，既没有构建 Stripe 会话（Session），也没有校验用户所有权，更没有获取 Stripe Checkout 会话来确认 为“已支付”且 与预期扣款金额一致。 因此，任何普通已认证用户都可以请求攻击者指定的金币数量，然后放弃或

CVSS 7.1 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54608

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MythicalDash: Unauthenticated payment bypass in Stripe success-redirect endpoint allows arbitrary free credit top-up
Source: CVE Program / CVE List V5
Vulnerability Description
MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app/Api/System/Gateways/Stripe.php creates a pending row in mythicaldash_stripe_payments before Stripe checkout succeeds and embeds the payment code in the success redirect, while GET /api/stripe/processed accepts that code without constructing a Session, checking ownership, or retrieving the Stripe Checkout Session to require payment_status to be paid and amount_total to match the expected charge. An ordinary authenticated user can request an attacker-selected coins amount, abandon or fail payment, and submit the pending code directly to the unauthenticated processed endpoint. StripeDB::isPending() then permits User::addCreditsAtomic() to grant the unpaid amount and mark the row processed even though Stripe has not confirmed payment. This permits arbitrary free virtual-currency top-ups and direct financial loss through consumption of hosting resources. No fixed version is available as of this review.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对数据真实性的验证不充分
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
MythicalLTD MythicalDash <= 3.5.4-aurora -

II. Public POCs for CVE-2026-54608

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54608

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-54608 (1)

Vendor Advisories for CVE-2026-54608 (1)

IV. Related Vulnerabilities

Same vendor: MythicalLTD
Same weakness: CWE-345

V. Comments for CVE-2026-54608

No comments yet

Leave a comment