AIKIDO-2025-10518

TL;DR

Affected versions are vulnerable to replay attacks and double spending due to missing transaction ID verification in the Saman payment driver's verify() method. Without this check, an attacker could potentially reuse a successful payment response or process the same payment multiple times, resulting in financial losses. The issue is resolved by comparing the stored transaction ID with the ResNum value returned by the payment gateway and automatically reversing the transaction if they do not match, thereby ensuring that each payment response corresponds to a valid and unique transaction.