PayRange App Flaws Enable Payment Interception
PayRange's Android app accepts spoofed TLS certificates and allows JavaScript injection, letting on-path attackers steal payment data and hijack vending hardware.
Researchers identified two vulnerabilities in version 7.0.7 of the PayRange mobile payment app, used to pay for vending machines, laundromats, and other unattended devices via Bluetooth. The first flaw (CVE-2026-13462) causes the app's WebViews to bypass Android's standard SSL trust chain, accepting any certificate—including self-signed ones—that matches loosely defined common-name and issuer rules referencing payrange.com, stripe.com, and fetlifestatus.com. This allows an attacker positioned on the network path to intercept and terminate TLS connections using a certificate they control.
The second vulnerability (CVE-2026-13461) permits JavaScript injection that can escape the WebView sandbox, enabling an attacker who has already established a man-in-the-middle position to execute arbitrary actions on the user's device. Combined, these flaws allow interception of any data a user submits through the app—including exchanges with PayRange and Stripe backend services—and, in the case of machine operators, could allow injected code to issue commands to PayRange hardware with full operator privileges.
CERT/CC was unable to reach the vendor to coordinate disclosure, so no patch is confirmed available at this time. Users and operators are advised to apply any available updates from their hardware or software vendors and to be cautious of untrusted networks when using the app.
Mentioned in this report
Detection guidance
TLS Certificate Validation Anomaly for PayRange/Stripe Domains (Potential MITM)
Detects TLS sessions to payrange.com, stripe.com, or fetlifestatus.com where the presented certificate fails standard chain validation (e.g., self-signed or untrusted issuer), consistent with exploitation of the PayRange WebView SSL trust bypass to intercept traffic. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: TLS Certificate Validation Anomaly for PayRange/Stripe Domains
id: 1f8183ac-32ed-5144-9296-6e9a5f22a250
status: experimental
description: 'Identifies TLS/SSL sessions where the server certificate for payrange.com,
stripe.com,
or fetlifestatus.com fails normal validation (self-signed, untrusted CA, or CN/issuer
mismatch). This pattern is consistent with an adversary-in-the-middle presenting
a
forged certificate that a vulnerable PayRange app WebView (CVE-2026-13462) would
improperly trust due to loose common-name/issuer matching rules.
'
references:
- CVE-2026-13462
author: Vorant
logsource:
category: network_connection
service: ssl
sdetection:
placeholder: true
detection:
selection:
subject|contains:
- payrange.com
- stripe.com
- fetlifestatus.com
filter_valid:
validation_status: ok
condition: selection and not filter_valid
falsepositives:
- Corporate TLS-inspection or SSL-decryption proxies that legitimately re-sign traffic
to these domains
- Internal test/staging environments using self-signed certificates for payrange.com-like
hostnames
- Misconfigured network monitoring sensors reporting validation errors for benign
reasons
level: medium
tags:
- attack.T1557
- attack.t1557.002
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/152953
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free