CVE-2014-10067: Validation Bypass in paypal-ipn

paypal-ipn Updated 02 Oct 2025

Summary

31/08/2020

Disclosed on

CVE-2014-10067

CVE

Yes i

Fix available

Moderate

Severity

5.9

CVSS Score

CVE-2014-10067: Validation Bypass in paypal-ipn. Affects paypal-ipn versions < 3.0.0. Fixed in 3.0.0. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

The paypal-ipn package is an npm package used for handling Instant Payment Notifications (IPN) from PayPal. It provides functionality to validate and process IPN messages sent by PayPal. The package is widely used in applications that integrate with PayPal for payment processing. However, versions 2.x.x and earlier of paypal-ipn are affected by a validation bypass vulnerability.

Vulnerability Detail

The vulnerability in paypal-ipn arises from the use of the test_ipn parameter, which is set by the PayPal IPN simulator. This parameter is used to determine whether the application should use the production PayPal site or the sandbox. An attacker can exploit this by crafting a request string using the simulator to trick the application into entering the sandbox mode. This could potentially allow purchases without valid payment, leading to financial loss for the application owner.

How To Fix

Minimum fixed version

3.0.0

This is the first release that contains the fix.

npm install paypal-ipn@3.0.0

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed version of the paypal-ipn package.

Conclusion

The paypal-ipn package versions 2.x.x and earlier are vulnerable to a validation bypass vulnerability. Upgrading to version 3.0.0 or later is recommended to fix the vulnerability. It is important to ensure that your application is not susceptible to unauthorized purchases and financial loss. For further support on vulnerability remediation, you can contact DevNack.com.

See every vulnerability recorded for paypal-ipn →