CVE-2026-111660
Received Received - Intake

Missing Authentication in waynboot-mall Allows Order Cancellation

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to auto-cancel unpaid orders and manipulate product stock levels.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111660
EUVD
EUVD-2026-103082

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wayn111 waynboot-mall 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing authentication flaw in waynboot-mall through version 2.0.0. It allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint by submitting predictable orderSn values. These values are generated using epoch seconds and a sequential counter, enabling attackers to manipulate product stock levels and disrupt order processing.

Detection Guidance

Monitor network traffic for POST requests to /callback/order/unpaid with predictable orderSn values. Check application logs for repeated order cancellations without user authentication. Inspect the UnpaidOrderController.java and OrderUnpaidServiceImpl.java files for improper validation in the cancellation logic.

Impact Analysis

Attackers can cancel unpaid orders without authentication, leading to unauthorized restocking of products and incorrect inventory updates. This may cause financial losses, disrupted order fulfillment, and potential stock discrepancies. The vulnerability also allows manipulation of order states, affecting business operations and customer trust.

Mitigation Strategies

Immediately restrict access to the /callback/order/unpaid endpoint by implementing authentication. Update to the latest version of waynboot-mall if a patch is available. Add server-side validation to verify order ownership before processing cancellations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111660. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart