CVE-2026-13462

HighCVSS 7.5

Published: 09/07/2026(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

PayRange Android app version 7.0.7 and below has an SSL bypass vulnerability that allows invalid certificates to be accepted in application webviews. A remote, unauthenticated attacker can steal information sent by the user.

Risk Assessment

The risk involves potential theft of sensitive data transmitted by the app, such as login credentials or payment information, without the user's knowledge.

Recommendation

It is recommended to immediately update the PayRange app to the latest available version that fixes this vulnerability.

Other vulnerabilities in PayRange

CVE-2026-13461Critical
A vulnerability in the PayRange app version 7.0.7 allows JavaScript injection into a WebView when combined with an SSL bypass. Injecting specific JavaScript function calls enables the attacker to escape the WebView sandbox and perform dangerous actions on the user's device.

Original NVD description (English source)

PayRange Android app, version 7.0.7 and below, contains an SSL bypass vulnerability that allows invalid certificates to be accepted in application webviews. A remote and unauthenticated attacker can steal information that the user sends.