CVE-2026-103671

{
  "etk_id": "ETK-2026-1986",
  "cve_id": "CVE-2026-103671",
  "display_id": "CVE-2026-103671",
  "ghsa_id": "GHSA-9xxh-8f25-hpwm",
  "euvd_id": "EUVD-2026-100939",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Externally controlled redirect parameter in EC-CUBE AmazonPay Plugin",
  "summary": "EC-CUBE 4-series deployments using the affected AmazonPay Plugin or AmazonPay V2 Plugin releases are affected. An attacker may cause a shopper to be sent to an attacker-chosen site during checkout, creating a risk of account-information theft. The shopper must interact with the ordering flow for the attack to succeed.",
  "mitigation": "Disable the affected AmazonPay checkout integration until the vendor supplies and you apply an update. Where disabling it is not feasible, limit checkout access to trusted users or networks and validate redirect destinations in the payment flow.",
  "vendor": "EC-CUBE CO.,LTD.",
  "product": "AmazonPay V2 Plugin (4.0/4.1 series)",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= v1.1.7, <= v1.1.12"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "AmazonPay V2 Plugin (4.0/4.1 series)",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= v1.0.0, <= v1.1.6"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "AmazonPay V2 Plugin (4.0/4.1 series)",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "v4.3.1"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "AmazonPay V2 Plugin (4.2/4.3 series, Bundle Edition)",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= v4.2.3, <= v4.3.1"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "AmazonPay V2 Plugin (4.2/4.3 series)",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= v4.2.0, <= v4.2.2"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "AmazonPay V2 Plugin (4.2/4.3 series)",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= v1.3.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "AmazonPay Plugin (4.0 series)",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 5.3,
  "cvss_src": "other",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
  "epss_score": 0.0022,
  "epss_percentile": 0.1221,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 50.579981966666665,
  "t0_at": "2026-10-14T08:12:13.594000+00:00",
  "signals": {
    "kev": {
      "at": "2026-10-14T00:00:00+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T08:12:13.594000+00:00",
      "precision": "day",
      "url": "https://vulncheck.com/cve/CVE-2026-103671"
    },
    "trigger_signal": {
      "at": "2026-10-14T00:00:00+00:00",
      "days": -0.34182400462962964,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T08:12:13.594000+00:00",
      "url": "https://vulncheck.com/cve/CVE-2026-103671"
    }
  }
}