CVE-2026-111660: waynboot-mall through 2.0.0 Missing Authentication via /callback/order/unpaid

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-16 · updated 2026-10-19
Weakness: CWE-306

Description

waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to auto-cancel unpaid orders and manipulate product stock levels.

Affected products

wayn111 waynboot-mall: through 2.0.0

References

https://github.com/wayn111/waynboot-mall/blob/v2.0.0/waynboot-common/src/main/java/com/wayn/common/core/service/shop/impl/OrderUnpaidServiceImpl.java#L36-L69
https://github.com/wayn111/waynboot-mall/blob/v2.0.0/waynboot-mobile-api/src/main/java/com/wayn/mobile/api/controller/callback/UnpaidOrderController.java#L26-L30
https://hackmd.io/@hieuPenguinnn/waynboot-mall-unauth-callback-order-forgery-cancel-mail-relay
https://www.vulncheck.com/advisories/waynboot-mall-through-2.0.0-missing-authentication-via-callback-order-unpaid
https://hackmd.io/@hieuPenguinnn/waynboot-mall-unauth-callback-order-forgery-cancel-mail-relay

Get alerted when CVE-2026-111660 or the next vulnerability affects your stack