Core v6.3.7

Release Date: April 17, 2026 Tags: SECURITY, PAYMENT GATEWAYS, BUG FIXES

Overview

Version 6.3.7 is a security-focused release that hardens every fiat payment gateway webhook against forged requests, cross-user crediting, double-credits, and amount tampering. All 13 gateway webhooks were reviewed and corrected to follow a single, consistent safety pattern.

This release contains fixes to money-handling code. We strongly recommend updating as soon as possible and configuring the new environment variables listed below before deploying.

Update Instructions

After updating, run the following command in terminal:

pnpm updator

Required Environment Variables

Some webhooks will now refuse to process requests (returning 503) if a signing secret is not configured. This is intentional — without these secrets the webhook cannot verify that the request actually came from the payment gateway. Set the following in your environment if you use the corresponding gateway:

• APP_KLARNA_WEBHOOK_SECRET — Klarna webhook signing secret
• APP_ADYEN_HMAC_KEY — Adyen HMAC key (hex-encoded, from Adyen Customer Area)
• APP_AUTHORIZENET_SIGNATURE_KEY — Authorize.Net webhook signature key

If you do not use a gateway, no action is needed for that gateway.

Upgrade Notes

• After updating, verify in staging that your real gateway sandboxes still deliver webhooks successfully. Adyen in particular has a significant change to HMAC verification and should be re-tested.
• Existing pending Paystack transactions created before this update may not match the fixed lookup until the next webhook arrives. Any stuck pre-update deposits should be inspected and resolved manually.

Fixed

Webhook Signatures Are Now Mandatory

Several webhooks previously accepted unsigned or unverified requests. They now reject any request that is not properly signed by the payment gateway:

• Fixed Klarna accepting unsigned callbacks. A valid Klarna-Signature header, verified against the configured webhook secret, is now required.
• Fixed 2Checkout treating its IPN signature as optional. It is now required.
• Fixed Adyen's HMAC verification not matching Adyen's documented per-item signing format, which in practice accepted unsigned requests.
• Fixed Authorize.Net treating signature verification as optional. It is now required.
• Fixed Paysafe treating signature verification as optional. It is now required.

Cross-User Payment Capture Blocked (PayPal)

• Fixed PayPal orders not being bound to the customer who created them. Any signed-in customer who learned a PayPal order ID could verify it and receive the credit for someone else's payment. Ownership is now checked and a mismatch is refused with 403 Forbidden.

Double-Credit Protection

• Fixed the return-URL verify flow and the background webhook being able to credit the same deposit twice. Both paths now share the same duplicate-detection key — whichever fires first records the credit and the second does nothing. This covers Klarna, Mollie, 2Checkout, Paystack, Stripe, PayPal, Adyen, Paytm, Authorize.Net, Paysafe, PayU and iPay88.

Amount and Currency Validation

• Fixed some gateways trusting the amount sent in the webhook payload. Every deposit webhook now verifies that the amount and currency the gateway reports match the pending transaction before crediting the wallet, and a mismatch is marked REJECTED with no credit made.

Refund and Chargeback Integrity (dLocal)

• Fixed dLocal refund and chargeback processing writing directly to wallet balances. It now goes through the audited wallet service, so a replayed refund webhook can no longer debit a customer's balance twice and each refund or chargeback produces a proper audit trail.

PII Reduction (PayFast)

• Fixed PayFast storing the full webhook body — including buyer name, email, and other personal details — in the transaction metadata. Only non-personal identifiers, status, and amounts are kept.

Paystack Deposit Confirmation

• Fixed the Paystack webhook looking up transactions by the wrong column, which caused valid payments to appear as "not found" and remain pending indefinitely. Webhooks now resolve to the correct transaction.

iPay88 Deposit Confirmation

• Fixed the iPay88 webhook transaction lookup. The previous lookup pattern never matched against the stored reference, causing webhooks to silently return FAIL for every payment. Webhooks now correctly locate the pending transaction.

Stripe Deposit Line Items

• Fixed Stripe's deposit and fee amounts being read by position rather than by name. If Stripe ever returned them in a different order the deposit amount and the fee could be swapped.

Underpayment Handling

• Fixed under-paid deposits — where the gateway reports a lower captured amount than the customer requested — being silently credited at the requested amount. They are now explicitly rejected. This affects Paystack, Paytm, Authorize.Net, Paysafe, Mollie, 2Checkout, Klarna, and Adyen.

Transaction Record Consistency

• Fixed PayPal verification leaving the pending transaction created at order time stuck in PENDING forever after a successful capture. It is now closed out.