High 7.1Published Oct 9, 2026

CVE-2026-107852Jexactyl: Stripe checkout confirmation accepts mismatched-currency/amount payments as full payment (payment forgery)

Updated under an hour ago (2026-10-19 08:30 UTC)

Does this affect you?

It affects Jexactyl. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.16%, higher than 5% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Jexactyl

Exploited in the last 30 days

Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when payment_status is paid but does not compare amount_total or currency with the referenced order and configured billing currency. On an instance where the billing module is enabled and a Stripe secret key is configured, an authenticated client can therefore complete a lower-value or mismatched-currency payment and cause the order to be processed, provisioning, renewing, upgrading, or unsuspending the purchased server for less than the required price. This issue is fixed in version 4.0.5.

CVSS: 7.1 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Weakness (CWE): CWE-345
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.16% (percentile 5)
Assigned by: GitHub_M
NVD analysis: Deferred
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Jexactyl Jexactyl jexactyl:jexactyl (from the name)	before 4.0.5	CNA record

References

https://github.com/Jexactyl/Jexactyl/security/advisories/GHSA-rf56-676w-hj4gx-refsource-confirm
https://github.com/Jexactyl/Jexactyl/commit/fdee722c560ac13dc2d26271912203a6085dffe3x-refsource-misc
https://github.com/Jexactyl/Jexactyl/releases/tag/v4.0.5x-refsource-misc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.