Sipay Issues 26.9.1 Patch to Plug OpenCart Signature Spoofing Hole in Versions 26.8.2 and Later

Sipay Electronic Money and Payment Services Inc. has released a security update for its OpenCart Virtual POS Module to address a critical vulnerability that could allow attackers to bypass payment verification. The company issued version 26.9.1 to remediate the issue, identified as CVE-2026-85531.

The flaw stems from improper verification of cryptographic signatures within the module. According to the National Vulnerability Database (NVD), this weakness enables signature spoofing by failing to properly validate the integrity of the data. The NVD assigns the vulnerability a CVSS score of 9.8, rating it as critical.

In plain English

Cryptographic signatures act as digital seals that prove a message or transaction has not been altered and comes from a trusted source. In the context of a Point of Sale (POS) system, these signatures ensure that the payment details sent from the checkout page to the payment processor are authentic.

When a system fails to verify these signatures correctly, an attacker can create fake signatures that the system accepts as valid. This is known as signature spoofing. In this specific case, the Sipay OpenCart module did not adequately check the validity of the incoming signatures. This gap allowed malicious actors to potentially manipulate transaction data or inject fraudulent payment requests, which the system would process as legitimate.

The background

The vulnerability exists in the Sipay OpenCart Virtual POS Module, a plugin used by merchants to accept payments on websites built with the OpenCart e-commerce platform. The issue affects module versions starting from 26.8.2 and continuing through any version prior to 26.9.1.

The weakness is categorized under CWE-347, which refers to improper verification of cryptographic signatures. This type of flaw is particularly dangerous in payment systems because it undermines the core security mechanism designed to prevent fraud and ensure transaction integrity. By exploiting this flaw, attackers could potentially interfere with the payment flow, leading to financial loss for merchants or customers.

What changes now

Sipay has confirmed the release of version 26.9.1, which contains the fix for CVE-2026-85531. This update corrects the improper validation logic that allowed for signature spoofing. Merchants and system administrators using the Sipay OpenCart Virtual POS Module should update their installations to version 26.9.1 or later to mitigate the risk.

There is no indication that the flaw has been exploited in the wild, but the critical severity rating suggests that immediate action is advisable. Until the patch is applied, systems running affected versions remain vulnerable to potential signature manipulation attacks.

What to do and how to stay safe: Sipay

• Check the current version of the Sipay OpenCart Virtual POS Module installed on your server.
• Upgrade to version 26.9.1 or any subsequent release as soon as possible to apply the security fix.
• Review transaction logs for any unusual activity or failed validation attempts that might indicate exploitation.
• Monitor vendor announcements for any further security advisories related to this module or OpenCart integrations.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of the Sipay OpenCart module are affected?

Versions from 26.8.2 up to, but not including, 26.9.1 are affected by this vulnerability.

What is the severity of CVE-2026-85531?

The NVD rates the vulnerability as critical with a CVSS score of 9.8.

Is there a fix available for this issue?

Yes, Sipay has released version 26.9.1 which addresses the improper signature verification flaw.