CVE-2026-105218: Go-Pay Gopay

High severity, CVSS 7.4. EPSS: 0.2% chance of exploitation in the next 30 days.

gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and transaction data, and modify payment, refund and order query responses.

Affected products

• Go-Pay Gopay: before 1.5.119 (fixed in 1.5.119)

Published 2026-10-04. Last modified 2026-10-06.