CVE-2026-26063
CediPay Affected by Improper Input Validation in Payment Processing
CediPay is a crypto-to-fiat app for the Ghanaian market. A vulnerability in CediPay prior to version 1.2.3 allows attackers to bypass input validation in the transaction API. The issue has been fixed in version 1.2.3. If upgrading is not immediately possible, restrict API access to trusted networks or IP ranges; enforce strict input validation at the application layer; and/or monitor transaction logs for anomalies or suspicious activity. These mitigations reduce exposure but do not fully eliminate the vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
CediPay Affected by Improper Input Validation in Payment Processing
CediPay is a crypto-to-fiat app for the Ghanaian market. A vulnerability in CediPay prior to version 1.2.3 allows attackers to bypass input validation in the transaction API. The issue has been fixed in version 1.2.3. If upgrading is not immediately possible, restrict API access to trusted networks or IP ranges; enforce strict input validation at the application layer; and/or monitor transaction logs for anomalies or suspicious activity. These mitigations reduce exposure but do not fully eliminate the vulnerability.
- Record
CVE-2026-26063- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2026-7985
CediPay is a crypto-to-fiat app for the Ghanaian market. A vulnerability in CediPay prior to version 1.2.3 allows attackers to bypass input validation in the transaction API. The issue has been fixed in version 1.2.3. If upgrading is not immediately possible, restrict API access to trusted networks or IP ranges; enforce strict input validation at the application layer; and/or monitor transaction logs for anomalies or suspicious activity. These mitigations reduce exposure but do not fully eliminate the vulnerability.
- Record
EUVD-2026-7985- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-wvr6-395c-5pxr
CediPay Affected by Improper Input Validation in Payment Processing
A vulnerability in CediPay allows attackers to bypass input validation in the transaction API.
Affected users: All deployments running versions prior to the patched release.
Risk: Exploitation could result in unauthorized transactions, exposure of sensitive financial data, and compromise of payment integrity.
Severity: High — potential financial loss and reputational damage.
Patches The issue has been fixed in version 1.2.3.
Users should upgrade to 1.2.3 or later immediately.
All versions earlier than 1.2.3 remain vulnerable.
Workarounds If upgrading is not immediately possible:
Restrict API access to trusted networks or IP ranges.
Enforce strict input validation at the application layer.
Monitor transaction logs for anomalies or suspicious activity.
These mitigations reduce exposure but do not fully eliminate the vulnerability.
References OWASP Input Validation Guidelines (owasp.org in Bing)
CWE-20: Improper Input Validation
GitHub Security Advisory Documentation (docs.github.com in Bing)
- Record
GHSA-wvr6-395c-5pxr- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
CediPay is a crypto-to-fiat app for the Ghanaian market. A vulnerability in CediPay prior to version 1.2.3 allows attackers to bypass input validation in the transaction API. The issue has been fixed in version 1.2.3. If upgrading is not immediately possible, restrict API access to trusted networks or IP ranges; enforce strict input validation at the application layer; and/or monitor transaction logs for anomalies or suspicious activity. These mitigations reduce exposure but do not fully eliminate the vulnerability.
- Record
CVE-2026-26063- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-wvr6-395c-5pxr
CediPay Affected by Improper Input Validation in Payment Processing
A vulnerability in CediPay allows attackers to bypass input validation in the transaction API.
Affected users: All deployments running versions prior to the patched release.
Risk: Exploitation could result in unauthorized transactions, exposure of sensitive financial data, and compromise of payment integrity.
Severity: High — potential financial loss and reputational damage.
Patches The issue has been fixed in version 1.2.3.
Users should upgrade to 1.2.3 or later immediately.
All versions earlier than 1.2.3 remain vulnerable.
Workarounds If upgrading is not immediately possible:
Restrict API access to trusted networks or IP ranges.
Enforce strict input validation at the application layer.
Monitor transaction logs for anomalies or suspicious activity.
These mitigations reduce exposure but do not fully eliminate the vulnerability.
References OWASP Input Validation Guidelines (owasp.org in Bing)
CWE-20: Improper Input Validation
GitHub Security Advisory Documentation (docs.github.com in Bing)
- Record
GHSA-wvr6-395c-5pxr- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cedipay-corenpm | before 1.2.3 | 1.2.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-26063 is a high vulnerability (CVSS 8.8) in Xpertforextradeinc Cedipay, published February 12, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. Fixed in cedipay-core 1.2.3.