CVE-2026-54810: Nexi XPay Missing Authorization Vulnerability (CVSS 7.5)

Technical summary

CVE-2026-54810 is a CWE-862 (Missing Authorization) vulnerability affecting Nexi XPay through version 8.3.1. The flaw stems from improperly configured access control security levels that fail to enforce proper privilege boundaries. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates network-accessible exploitation with low attack complexity, no privilege requirements, and high availability impact. The confidentiality and integrity scores are unaffected, suggesting the primary risk is denial of service or resource exhaustion rather than data theft or modification.

Business impact

For payment processors and merchants using Nexi XPay, this vulnerability creates operational and compliance risk. Attackers could disrupt payment processing services, trigger downtime, or exhaust system resources, directly impacting revenue and customer trust. In payment card industry (PCI) contexts, authorization bypass vulnerabilities are critical compliance failures. Organizations relying on XPay for transaction handling should treat this as a high-priority issue requiring rapid assessment and remediation to avoid regulatory penalties and service interruption.

Affected systems

Nexi XPay versions up to and including 8.3.1 are vulnerable. The vendor product list is not populated in available threat intelligence, so affected deployments should be identified through asset inventory systems and direct outreach to Nexi. Any organization running XPay should verify their installed version immediately and check whether patches are available from Nexi.

Exploitability

This vulnerability is straightforward to exploit from a network perspective. No authentication, credentials, or user interaction is required—an attacker simply needs network connectivity to the vulnerable XPay instance. The low attack complexity indicates that exploitation does not depend on special conditions or timing; however, the specific access paths and payload construction depend on how the authorization checks are implemented. Organizations should assume active exploitation is likely given the ease of triggering the vulnerability.

Remediation

The primary remediation is to patch Nexi XPay to a version that addresses CWE-862. Contact Nexi directly for patch availability and release notes. Until patching is feasible, implement network segmentation to restrict access to XPay instances, require VPN or IP whitelisting for administrative and API endpoints, and increase monitoring for unauthorized access attempts. Apply the principle of least privilege to all service accounts interacting with XPay.

Patch guidance

Verify with Nexi's security advisories whether a patch exists for Nexi XPay beyond version 8.3.1. If you are running 8.3.1 or earlier, contact Nexi support immediately for patch availability, timelines, and deployment procedures. Apply patches in a change management window after testing in a non-production environment. Document the patching process and verify successful remediation by confirming the updated version post-deployment and re-testing access control enforcement.

Detection guidance

Monitor logs for access attempts to protected functions or endpoints without proper authorization tokens or sessions. Alert on HTTP 403 (Forbidden) responses that transition to successful 200 responses from the same source, indicating potential authorization bypass. Review XPay admin and API audit logs for unusual access patterns, role elevation, or access to privileged resources by unexpected accounts. Network intrusion detection systems should flag suspicious requests to known XPay endpoints. Implement baseline access control testing within your security scanning to detect misconfigurations post-patch.

Why prioritize this

This vulnerability merits immediate attention due to high CVSS severity (7.5), network accessibility, zero authentication barriers, and direct impact on payment processing availability. Given XPay's role in payment transaction handling, even temporary service disruption carries significant business cost. The absence of CISA KEV status does not diminish the priority; active exploitation is likely because the attack surface is trivial. Payment processors and merchants should prioritize this above lower-severity issues.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a high-impact availability attack that is easy to execute and requires no special access. The network attack vector (AV:N) and lack of privilege requirements (PR:N) make this broadly exploitable. While confidentiality and integrity impact are null, the high availability impact (A:H) reflects resource exhaustion or denial-of-service potential. In a payment processing context, availability is mission-critical, elevating business risk beyond the numerical score alone.

Frequently asked questions