CRITICAL ALERT CVE-2026-6194 CVSS 9.4 8 hours ago

CERT-In & RBI Issue Urgent Cyber Advisory on UPI Fast-Payment Gateway BOLA Vulnerabilities

By Rajeshwar Sen (BFSI Cyber Compliance Lead, BlueCiphr)

          60-SECOND EXECUTIVE TL;DR
        

Broken Object Level Authorization (BOLA) in merchant payment callbacks permitted transaction tampering.

Flaw enabled malicious actors to forge callback signatures and trigger unauthorized settlement confirmations.
CERT-In has enforced strict 6-hour mandatory incident reporting under 2022 Cybersecurity Directives.
RBI Master Direction audits to require immediate verification of HMAC key rotation across all banking partners.

Immediate Mitigation: Deploy API authorization middleware enforcing tenant token binding and validate SHA-256 HMAC callbacks.

The Indian Computer Emergency Response Team (CERT-In) and the Reserve Bank of India (RBI) have jointly released an urgent technical advisory addressing critical Broken Object Level Authorization (BOLA) vulnerabilities discovered in automated payment callback endpoints. The vulnerability allows an unauthenticated adversary to modify transaction reference IDs during server-to-server webhook execution, falsely confirming settlement credits without actual fund transfers. ### Regulatory Mandates Under the CERT-In Cybersecurity Directives and RBI Master Direction on Cyber Resilience: 1. All regulated financial entities must audit API endpoints for OWASP API1:2023 vulnerabilities immediately. 2. Any confirmed exploit attempt must be reported to the CERT-In Incident Desk within **6 hours**. 3. BlueCiphr's VAPT practice provides priority BFSI compliance scoping to validate payment gateway posture.

        ⚡ TARGETED EXPOSURE ASSESSMENT
      

Is Your Enterprise Infrastructure Vulnerable to CVE-2026-6194 or Similar Attack Vectors?

Do not wait for active weaponization. Connect with BlueCiphr’s accredited CEH Master & PenTest+ lead ethical hackers to conduct a confidential, controlled exposure assessment across your APIs, web applications, and cloud endpoints with Quick Response SLA.

Schedule Targeted Vulnerability Consultation → ⚡ Quick Response SLA • Strict Confidentiality