DRUPAL-CONTRIB-2026-264

See a problem?
Import Source
https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/commerce_stripe/DRUPAL-CONTRIB-2026-264.json
JSON Data
https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2026-264
Aliases
  • CVE-2026-118559
Published
2026-10-28T16:56:52Z
Modified
2026-10-28T19:19:43Z
Summary
[none]
Details

This module enables you to take payments via multiple Stripe APIs.

The module doesn't sufficiently verify the cryptographic signature of a webhook event when a signing secret has not been properly configured in the payment gateway settings.

This vulnerability is mitigated by the fact that not all payment gateway plugins in the module utilize webhooks. Furthermore, any payment gateway configuration with any value for its webhook signing secret will prevent inappropriate processing.

References
Credits

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/commerce_stripe

Package

Name
drupal/commerce_stripe
Purl
pkg:composer/drupal/commerce_stripe?repository_url=https:%2F%2Fpackages.drupal.org%2F8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.4.0
Database specific
Show details 
{
    "constraint":  "<1.4"
}
Type
ECOSYSTEM
Events
Introduced
2.0.0
Fixed
2.2.3
Database specific
Show details 
{
    "constraint":  ">=2.0.0 <2.2.3"
}

Database specific

affected_versions 
"<1.4 || >=2.0.0 <2.2.3"
source 
"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/commerce_stripe/DRUPAL-CONTRIB-2026-264.json"