What is GHSA-v26j-p538-j93h?

GHSA-v26j-p538-j93h is a security advisory published by GitHub Security Advisories with High severity. Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc...

Which CVE IDs does GHSA-v26j-p538-j93h cover?

GHSA-v26j-p538-j93h covers the following CVE IDs: CVE-2026-16037. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-v26j-p538-j93h?

GHSA-v26j-p538-j93h has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-v26j-p538-j93hHighCVSS 7.5

Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc...

Vendor

GitHub Security Advisories

Published

September 8, 2026

Last Modified

September 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-16037 →

📋 Description

Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API (v9x) WHMCS Module allows Black Box Reverse Engineering.

This issue affects PayTR Virtual Pos iFrame API (v9x) WHMCS Module: from v9.0.0 before v9.0.3.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-16037
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1034
https://github.com/advisories/GHSA-v26j-p538-j93h