Sipay PrestaShop Module Patched for Critical Signature Spoofing Flaw

Sipay Electronic Money and Payment Services Inc. has resolved a critical security vulnerability in its PrestaShop Virtual POS Module by releasing version 26.9.1. The update addresses a flaw that allowed attackers to bypass cryptographic signature checks, potentially compromising the integrity of payment transactions.

The vulnerability, tracked as CVE-2026-86405, stems from improper verification of cryptographic signatures within the module. According to the National Vulnerability Database (NVD), this weakness enables signature spoofing by failing to properly validate the cryptographic data. The NVD assigns the issue a CVSS score of 9.8, categorizing it as critical. The flaw is mapped to CWE-347, which identifies the core issue as improper verification of cryptographic signatures.

Context and Background

Cryptographic signature verification is a fundamental security control in payment processing systems. It ensures that data has not been altered in transit and that it originates from a trusted source. When this verification process is flawed, as seen in CVE-2026-86405, an attacker can forge valid signatures. This allows them to inject malicious data or modify transaction details without detection by the receiving system.

The PrestaShop Virtual POS Module is an integration tool that allows e-commerce platforms built on the PrestaShop framework to accept payments via Sipay’s infrastructure. Because this module handles sensitive financial data, any weakness in its validation logic poses significant risks to merchants and their customers. The specific failure mode here involves the module accepting spoofed signatures, which undermines the trust model required for secure electronic money transfers.

Who Is Affected

The vulnerability impacts users of the Sipay PrestaShop Virtual POS Module who are running versions prior to 26.9.1. Specifically, the NVD record indicates that the issue affects versions starting from 26.8.1 up to, but not including, 26.9.1. Merchants and system administrators managing PrestaShop installations that integrate with Sipay for payment processing are the primary group at risk.

Organizations that have already updated to version 26.9.1 are no longer susceptible to this specific vector. However, those still operating on version 26.8.1 or any intermediate build before the release of 26.9.1 remain exposed to potential exploitation. The severity of the CVSS score suggests that successful exploitation could have a high impact on confidentiality, integrity, and availability.

What should you do?

Security teams should immediately audit their PrestaShop installations to determine the current version of the Sipay Virtual POS Module. If the installed version is below 26.9.1, the module should be updated to the latest release to mitigate the risk of signature spoofing. Administrators should also review transaction logs for any anomalies that might indicate prior exploitation, such as unexpected changes in payment amounts or recipient details.