CVE-2026-107852: Stripe payment validation bypass

CISO Take

Jexactyl, a game server management panel with a billing module, fails to compare the amount and currency of a client-supplied Stripe Checkout Session against the order, so an authenticated customer can pay a trivially small or wrong-currency amount and still receive a provisioned, renewed, upgraded or unsuspended server. This is a business-logic and financial-integrity flaw (CWE-345), not a code execution or data breach issue, and it has no meaningful AI/ML attack surface beyond the panel's classification as an ML UI. No CVSS or EPSS score is published, it is not in CISA KEV, and there is no public exploit or Nuclei template, so near-term mass exploitation is unlikely, though the attack needs only a valid account and a cheap Stripe payment. Only instances with the billing module enabled and a Stripe secret key configured are exposed, so hosting providers reselling servers or compute through Jexactyl carry direct revenue-leakage risk. Upgrade to Jexactyl 4.0.5 and reconcile past Stripe payments against order totals to find any abuse.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

Low-to-moderate and mostly financial. Exploitation requires an authenticated client account and a billing-enabled instance with Stripe configured. There is no known exploitation, no public exploit, no KEV listing and no EPSS data. Impact is limited to integrity of payment validation (revenue loss and unauthorized resource provisioning). Confidentiality and availability are not directly affected. Severity is unrated, and the AI/ML relevance is tangential because Jexactyl is a general game server panel and no AI/ML-specific component is documented as affected.

How does the attack unfold?

Initial Access

Attacker registers or uses an existing client account on a Jexactyl instance with billing and Stripe enabled.

AML.T0012

Exploitation

Attacker pays a low-value or wrong-currency Stripe Checkout Session and submits it to the process endpoint, which checks only payment_status.

AML.T0049

Impact

The order is processed and the server is provisioned, renewed, upgraded or unsuspended at less than the required price.

AML.T0048.000

Initial Access

Attacker registers or uses an existing client account on a Jexactyl instance with billing and Stripe enabled.

AML.T0012

Exploitation

Attacker pays a low-value or wrong-currency Stripe Checkout Session and submits it to the process endpoint, which checks only payment_status.

AML.T0049

Impact

The order is processed and the server is provisioned, renewed, upgraded or unsuspended at less than the required price.

AML.T0048.000

How severe is it?

CVSS 3.1

N/A

EPSS

0.2%

chance of exploitation in 30 days

Higher than 9% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What should I do?

1 step

1) Upgrade Jexactyl to version 4.0.5 or later, which adds amount_total and currency checks. 2) Until patched, disable the billing module or remove the Stripe secret key to turn off the vulnerable /api/client/billing/stripe/process endpoint. 3) Audit historical Stripe Checkout Sessions against order totals and currencies to find underpaid orders, and suspend or remediate affected servers. 4) Monitor POST requests to /api/client/billing/stripe/process for sessions whose amounts differ from the order price. 5) Use Stripe webhooks with server-side verification of amount and currency as a defense in depth.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassSocial EngineeringFrameworkAPIAML.T0012- Valid Accounts AML.T0048.000- Financial Harm AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Risk treatment and response to previously unknown risks

Frequently Asked Questions

What is CVE-2026-107852?

Jexactyl, a game server management panel with a billing module, fails to compare the amount and currency of a client-supplied Stripe Checkout Session against the order, so an authenticated customer can pay a trivially small or wrong-currency amount and still receive a provisioned, renewed, upgraded or unsuspended server. This is a business-logic and financial-integrity flaw (CWE-345), not a code execution or data breach issue, and it has no meaningful AI/ML attack surface beyond the panel's classification as an ML UI. No CVSS or EPSS score is published, it is not in CISA KEV, and there is no public exploit or Nuclei template, so near-term mass exploitation is unlikely, though the attack needs only a valid account and a cheap Stripe payment. Only instances with the billing module enabled and a Stripe secret key configured are exposed, so hosting providers reselling servers or compute through Jexactyl carry direct revenue-leakage risk. Upgrade to Jexactyl 4.0.5 and reconcile past Stripe payments against order totals to find any abuse.

Is CVE-2026-107852 actively exploited?

No confirmed active exploitation of CVE-2026-107852 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-107852?

1) Upgrade Jexactyl to version 4.0.5 or later, which adds amount_total and currency checks. 2) Until patched, disable the billing module or remove the Stripe secret key to turn off the vulnerable /api/client/billing/stripe/process endpoint. 3) Audit historical Stripe Checkout Sessions against order totals and currencies to find underpaid orders, and suspend or remediate affected servers. 4) Monitor POST requests to /api/client/billing/stripe/process for sessions whose amounts differ from the order price. 5) Use Stripe webhooks with server-side verification of amount and currency as a defense in depth.

What systems are affected by CVE-2026-107852?

This vulnerability affects the following AI/ML architecture patterns: Hosting and billing panels, Self-service resource provisioning portals, Payment processing integrations.

What is the CVSS score for CVE-2026-107852?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

Hosting and billing panelsSelf-service resource provisioning portalsPayment processing integrations

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0048.000Financial Harm

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when payment_status is paid but does not compare amount_total or currency with the referenced order and configured billing currency. On an instance where the billing module is enabled and a Stripe secret key is configured, an authenticated client can therefore complete a lower-value or mismatched-currency payment and cause the order to be processed, provisioning, renewing, upgrading, or unsuspending the purchased server for less than the required price. This issue is fixed in version 4.0.5.

Exploitation Scenario

An authenticated customer places an order for a high-priced server. Instead of paying the order total, they create a Stripe Checkout Session with a minimal amount, or in a different currency, and pay it. They then submit that paid session ID to POST /api/client/billing/stripe/process. The server checks only that payment_status is paid and not the amount or currency, so it marks the order paid and provisions or unsuspends the server. The attacker repeats this to obtain servers, upgrades and renewals at a fraction of the price.

Weaknesses (CWE)

CWE-345Insufficient Verification of Data AuthenticityPrimary CWE-345Insufficient Verification of Data Authenticity

CWE-345 — Insufficient Verification of Data Authenticity: The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Source: MITRE CWE corpus.