gopay vulnerabilities

1 known vulnerability in gopay from Go-pay. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.4 High severity

  gopay: Improper Certificate Validation

  CVE-2026-105218Oct 4, 2026Go-pay

  gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and