Sipay PrestaShop Module Flaw Lets Attackers Forge Payment Signatures

Sipay Electronic Money and Payment Services Inc. has a critical security gap in its PrestaShop Virtual POS Module that allows attackers to bypass essential security checks. This flaw enables signature spoofing, meaning malicious actors can create fake digital signatures that the system accepts as legitimate. For businesses relying on this module for online transactions, the risk involves compromised payment integrity and potential fraud.

In plain English

Digital signatures act like sealed envelopes for data, proving that information has not been tampered with and comes from a trusted source. In this case, the Sipay module is supposed to verify these seals before processing a payment request. However, the vulnerability means the module fails to properly validate these signatures. An attacker can craft a fake signature that looks real to the system. This allows them to alter transaction details or inject malicious data without the merchant or payment processor realizing the request was forged. It is similar to a forger creating a check that passes bank verification because the bank’s scanner fails to spot the fake ink.

The background

The National Vulnerability Database (NVD) catalogued this issue as CVE-2026-86405. The record classifies the weakness under CWE-347, which relates to improper verification of cryptographic signatures. The vulnerability specifically impacts the PrestaShop Virtual POS Module developed by Sipay. According to the NVD, any version of the module starting from 26.8.1 and preceding version 26.9.1 is affected. The CVSS score of 9.8 places this in the critical category, indicating a high likelihood of successful exploitation and severe impact on confidentiality, integrity, or availability.

What changes now

Organizations using the affected versions of the Sipay module face immediate exposure to signature forgery attacks. Because the flaw allows improper validation, attackers do not need to break complex encryption; they simply need to bypass the broken check. This creates a direct path for manipulating payment flows. Until a secure version is deployed, any transaction processed through these older module versions lacks guaranteed integrity. Security teams must treat this as an urgent operational risk, as the ability to spoof signatures undermines the trust model of electronic payments.

What to do and how to stay safe: Sipay

• Inventory all PrestaShop installations to identify if the Sipay Virtual POS Module is installed and check its version number.
• If the version is 26.8.1 or any version before 26.9.1, prioritize upgrading to version 26.9.1 or later once available to close the vulnerability.
• Monitor payment logs for unusual patterns or discrepancies that might indicate forged transactions while the system remains unpatched.
• Restrict administrative access to the PrestaShop backend to reduce the attack surface while remediation is pending.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of the Sipay module are vulnerable?

Versions starting from 26.8.1 and ending before 26.9.1 are affected by this signature spoofing vulnerability.

What is the severity of CVE-2026-86405?

The Common Vulnerability Scoring System rates this vulnerability as 9.8, which is considered critical.

How does this vulnerability work?

It allows signature spoofing through improper validation of cryptographic signatures in the Sipay PrestaShop Virtual POS Module.