CVE-2026-101275pretix pretix-adyen
NVD
Vulnerability Summary
Our payment integration with Adyen did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.
CVSS v4.0 Base Metrics — Score 6.3 (MEDIUM)
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:NAttack VectorNetwork
Attack ComplexityHigh
Attack RequirementsPresent
Privileges RequiredNone
User InteractionNone
Confidentiality (Vulnerable System)None
Integrity (Vulnerable System)Low
Availability (Vulnerable System)None
Confidentiality (Subsequent System)None
Integrity (Subsequent System)Low
Availability (Subsequent System)None
Affected & Patched Versions
- pretix pretix-adyen < 1.5.4
- pretix pretix-adyen 1.5.4
What to do
Fix it during your normal patch cycle. No exploitation is confirmed yet.
- Check whether you run pretix pretix-adyen and which version.
- Update to a patched version listed above, then confirm the new version.
Timeline
- Nov 10, 2026Published
- Nov 10, 2026Record last modified
Score, severity and exploitation changes are tracked from the day Watchtower started logging them.
Get notified about new pretix pretix-adyen CVEsYou are reading CVE-2026-101275. Get an email when KEV listings, exploits or new CVEs match your stack.
Set up CVE alertsExternal References
Data last checked: Nov 14, 2026 01:09 UTC