CVE-2026-77694

Name of the Vulnerable Software and Affected Versions Eventin versions prior to 4.1.19

Description An issue exists where the software does not properly restrict the changes a guest checkout token can authorize on an order. This allows unauthenticated users to mark their own unpaid orders as completed, resulting in the issuance of a valid paid ticket without any payment being processed. The exploitation involves the order token variable.

Recommendations Update to version 4.1.19 or later.