CVE-2026-105850: Payment Settlement Replay Without Atomic Claimcve-2026-105850-payment-settlement-replay-without-atomic-claim
Order settlement creates the order document directly inside a request-driven payment confirmation flow without an atomic exactly-once claim on the associated transaction. Because the settlement create runs inside a request context (req) after only a payment-provider status check, any replayed or concurrent confirm request that resolves the same client-suppli
