Skip to main content

CISA warns PayRange Android 7.0.7 has TLS and WebView issues

Source Decision Insights Threat Desk Published August 23, 2026 Companies 1
Human View Machine View

45th article in the last 90 days, one of 588 articles referencing Cybersecurity and Infrastructure Security Agency (CISA). Previous coverage: CISA Issues Guidance on Duplicati v2.3.0.1 Vulnerability CVE-2026-16157 (Aug 2026).

Companies mentioned

Best suited for

Seniority
Analyst
Job function
Cybersecurity / Security Engineer
Persona
Security Operations Practitioner
Buyer role
Technical Implementer / Administrator
Decision stage
Post Buy
Adoption curve
Early Adopters
Technology maturity
Emerging Exploration
Industry
Information Technology / Software & Services / IT Services / Consumer Internet

Our classification, not the publisher's statement. Best suited for, not only for.

PayRange, a mobile payment app, has two vulnerabilities in version 7.0.7 that affect how the app handles SSL certificates in application WebViews and how JavaScript input is processed. The issues enable an on-path interception scenario that can lead to interception of user-provided information and, in some cases, execution of actions with the permissions of a machine operator.

CVE-2026-13462 is a vulnerability in the PayRange Android app that causes invalid SSL certificates to be accepted in application WebViews. CVE-2026-13461 is a second vulnerability that allows the injection of JavaScript, which can be used to escape the WebView sandbox and perform dangerous actions on the user’s device. The app bypasses Android’s SSL trust chain and accepts certificates matching rule sets based on Common Name and issuer details, including certificates with self-signed issuers. The certificate acceptance rules are: Common Name ends with “payrange.com”; Common Name contains “stripe.com”; and Common Name contains “fetlifestatus.com” plus any of these conditions: Issuer Common Name is “R10”, Issuer Common Name is “R3”, or Issuer Common Name contains “Network Solutions.” The described attack vector is on-path interception in which an attacker can direct traffic intended for a legitimate server to a device they control, negotiate a TLS connection using any trusted certificate that matches the rule set, inject content into the WebView, and harvest credentials, issue malicious requests, and read data entered by the user, including exchanges with PayRange and Stripe servers.

An attacker may be able to intercept any information they can convince the user to send through the app. If the user is a machine operator, injected JavaScript code can connect to PayRange hardware and issue commands with the full permissions of the operator.

Coordination with the vendor was not completed. The guidance provided is to apply the latest software updates provided by the hardware or software vendor as they become available.

Thanks to Tahi Wilton Geary for reporting the vulnerability. The document was written by Bob Kemerer. Reference information in the advisory includes https://payrange.com/ and the Google Play listing at https://play.google.com/store/apps/details?id=com.payrange.payrange&hl=en-US. The advisory lists CVE IDs as CVE-2026-13462 and CVE-2026-13461, with dates public, first published, and last updated shown as 2026-07-09 and last updated time as 2026-07-09 17:14 UTC.

Blog post, originally published at kb.cert.org.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-warns-payrange-android-7.0.7-has-tls-and-webview-issues/",
        "name": "CISA warns PayRange Android 7.0.7 has TLS and WebView issues",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-warns-payrange-android-7.0.7-has-tls-and-webview-issues/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
      "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
    },
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Seniority",
        "audienceType": "Analyst"
      },
      {
        "@type": "Audience",
        "additionalType": "Job function",
        "audienceType": "Cybersecurity / Security Engineer"
      },
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Practitioner"
      },
      {
        "@type": "Audience",
        "additionalType": "Buyer role",
        "audienceType": "Technical Implementer / Administrator"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Adopters"
      },
      {
        "@type": "Audience",
        "additionalType": "Technology maturity",
        "audienceType": "Emerging Exploration"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Software & Services / IT Services / Consumer Internet"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T13:07:19-06:00",
    "datePublished": "2026-08-23T09:44:05-06:00",
    "description": "CISA issues guidance on PayRange Android 7.0.7 vulnerabilities: invalid TLS certificates accepted in WebViews and JavaScript injection via WebView escape.",
    "headline": "CISA warns PayRange Android 7.0.7 has TLS and WebView issues",
    "isBasedOn": {
      "@type": "CreativeWork",
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/152953"
    },
    "keywords": [
      "Application",
      "Certificates",
      "Software",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-warns-payrange-android-7.0.7-has-tls-and-webview-issues/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      },
      {
        "@id": "https://decisioninsights.ai/projects/ietf-tls-protocol/#project",
        "@type": "SoftwareSourceCode",
        "mainEntityOfPage": "https://decisioninsights.ai/projects/ietf-tls-protocol/",
        "name": "IETF TLS Protocol"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages