CVE-2012-5793: The Authorize.Net module in osCommerce does not verify that the server hostname matches a domain name in th...

Security readout for executives and security teams

CVE-2012-5793 is a payment-integration weakness in the osCommerce Authorize.Net module. It fails to confirm that a TLS certificate belongs to the expected server, so an attacker in a man-in-the-middle position could impersonate the payment endpoint using another valid certificate. Exposure is limited to environments using the affected osCommerce Authorize.Net module. The source bundle does not identify affected versions, CPEs, package names, or whether current deployments remain vulnerable. Treat this as a targeted legacy payment-system risk. Prioritize validation if osCommerce handles live payments, but do not assume broad exposure or active exploitation from the provided evidence. Mitigation focus: Inventory osCommerce deployments using the Authorize.Net module.; Check osCommerce and Authorize.Net vendor guidance for fixed or supported integrations.; Replace unsupported payment modules with maintained integrations that validate TLS hostnames..

Prepared

Jun 24, 2026, 12:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.