Wednesday, April 29, 2026
1 change · saas-18.4
Security fixes and vulnerability patches
Xendit payment requests now require a valid access token linked to the specific transaction before payment can be processed. This prevents payments from being executed using only a transaction reference, reducing the risk of unauthorized or incorrect payment actions.
Original PR description
**Description of the issue/feature this PR addresses:** The `/payment/xendit/payment` endpoint did not enforce validation of an access token tied to the transaction when processing direct payment requests. **Current behavior before PR:** The endpoint accepted public requests using only the transaction reference, allowing payment execution without verifying that the request was linked to the intended transaction. **Desired behavior after PR is merged:** The endpoint now requires a valid access_token associated with the transaction (reference) before processing. This ensures that payment execution is restricted to the correct transaction. --- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr Forward-Port-Of: odoo/odoo#261616 Forward-Port-Of: odoo/odoo#260258