CVE-2026-13603: SSRF with API key leak in pretix-oppwa

Synopsis

A server-side request forgery (SSRF) vulnerability exists in the pretix-oppwa payment integration plugin, which connects the pretix ticketing system to payment providers built on Oppwa technology such as VR Payment and Hobex. The plugin can be reached over the network by any unauthenticated user and requires no victim interaction to exploit. A successful attack causes the pretix server to send an outbound HTTP request carrying its Oppwa API key to an attacker-controlled host, leaking the key and granting the attacker full access to the connected payment provider account. A patched-image rebuild at version 1.4.4 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the pretix payment callback endpoint over the network; no special network position is required beyond a standard internet connection.

• AuthenticationNot required

  No account or credential of any kind is needed; the attacker manipulates a publicly accessible callback URL query parameter.

• Victim interactionNot required

  The exploit is fully server-side; no user needs to click a link or take any action for the attack to succeed.

• Attack complexityDetail

  Exploitation is straightforward and condition-free: the attacker simply crafts a resourcePath value that redirects the outbound request, with no race condition or environmental dependency required.

Blast Radius

• The attacker receives the Oppwa API access token in the inbound request to their server, giving them full programmatic access to the payment provider account.
• With a stolen API key, the attacker can read transaction records and customer payment data stored in the payment provider's system.
• The attacker can make modifications in the payment provider's system at the scope permitted by the stolen token, including altering or voiding transaction records.
• Availability impact on the pretix service itself is low, but compromise of the payment provider account can disrupt payment processing for all events using the affected integration.