{"cve":"CVE-2026-26063","nvd":{"published":"2026-02-19T20:25:41.910","modified":"2026-06-17T10:25:40.183","status":"Deferred","description":"CediPay is a crypto-to-fiat app for the Ghanaian market. A vulnerability in CediPay prior to version 1.2.3 allows attackers to bypass input validation in the transaction API. The issue has been fixed in version 1.2.3. If upgrading is not immediately possible, restrict API access to trusted networks or IP ranges; enforce strict input validation at the application layer; and/or monitor transaction logs for anomalies or suspicious activity. These mitigations reduce exposure but do not fully eliminate the vulnerability.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","score":8.8},"cvss_v3":null,"cwes":["CWE-20"],"references":["https://github.com/xpertforextradeinc/CediPay/security/advisories/GHSA-wvr6-395c-5pxr"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:23:35.260773158+00:00"},"epss":{"cve":"CVE-2026-26063","score":0.00312,"percentile":0.24059,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-wvr6-395c-5pxr","url":"https://osv.dev/vulnerability/GHSA-wvr6-395c-5pxr","summary":"CediPay Affected by Improper Input Validation in Payment Processing","modified":"2026-02-19T22:07:42.080664Z","packages":[{"ecosystem":"npm","name":"cedipay-core","purl":"pkg:npm/cedipay-core","ranges":["<1.2.3"],"fixed":["1.2.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}