# PayRange App Flaws Enable Payment Interception

Published: 2026-07-09 · Severity: medium · Sectors: retail
Canonical: https://vorant.io/reports/632d1e1d-0f83-5971-8bf0-79759ac494ad/payrange-app-flaws-enable-payment-interception

> PayRange's Android app accepts spoofed TLS certificates and allows JavaScript injection, letting on-path attackers steal payment data and hijack vending hardware.

Researchers identified two vulnerabilities in version 7.0.7 of the PayRange mobile payment app, used to pay for vending machines, laundromats, and other unattended devices via Bluetooth. The first flaw (CVE-2026-13462) causes the app's WebViews to bypass Android's standard SSL trust chain, accepting any certificate—including self-signed ones—that matches loosely defined common-name and issuer rules referencing payrange.com, stripe.com, and fetlifestatus.com. This allows an attacker positioned on the network path to intercept and terminate TLS connections using a certificate they control.

The second vulnerability (CVE-2026-13461) permits JavaScript injection that can escape the WebView sandbox, enabling an attacker who has already established a man-in-the-middle position to execute arbitrary actions on the user's device. Combined, these flaws allow interception of any data a user submits through the app—including exchanges with PayRange and Stripe backend services—and, in the case of machine operators, could allow injected code to issue commands to PayRange hardware with full operator privileges.

CERT/CC was unable to reach the vendor to coordinate disclosure, so no patch is confirmed available at this time. Users and operators are advised to apply any available updates from their hardware or software vendors and to be cautious of untrusted networks when using the app.

## Mentioned in this report

- Vulnerabilities: CVE-2026-13461, CVE-2026-13462

## Detection guidance (public sample)

### TLS Certificate Validation Anomaly for PayRange/Stripe Domains (Potential MITM)

ATT&CK: T1557

Detects TLS sessions to payrange.com, stripe.com, or fetlifestatus.com where the presented certificate fails standard chain validation (e.g., self-signed or untrusted issuer), consistent with exploitation of the PayRange WebView SSL trust bypass to intercept traffic. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: TLS Certificate Validation Anomaly for PayRange/Stripe Domains
id: 1f8183ac-32ed-5144-9296-6e9a5f22a250
status: experimental
description: 'Identifies TLS/SSL sessions where the server certificate for payrange.com,
  stripe.com,

  or fetlifestatus.com fails normal validation (self-signed, untrusted CA, or CN/issuer

  mismatch). This pattern is consistent with an adversary-in-the-middle presenting
  a

  forged certificate that a vulnerable PayRange app WebView (CVE-2026-13462) would

  improperly trust due to loose common-name/issuer matching rules.

  '
references:
- CVE-2026-13462
author: Vorant
logsource:
  category: network_connection
  service: ssl
sdetection:
  placeholder: true
detection:
  selection:
    subject|contains:
    - payrange.com
    - stripe.com
    - fetlifestatus.com
  filter_valid:
    validation_status: ok
  condition: selection and not filter_valid
falsepositives:
- Corporate TLS-inspection or SSL-decryption proxies that legitimately re-sign traffic
  to these domains
- Internal test/staging environments using self-signed certificates for payrange.com-like
  hostnames
- Misconfigured network monitoring sensors reporting validation errors for benign
  reasons
level: medium
tags:
- attack.T1557
- attack.t1557.002
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://kb.cert.org/vuls/id/152953

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/632d1e1d-0f83-5971-8bf0-79759ac494ad/payrange-app-flaws-enable-payment-interception.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup