CVE-2026-81159

Name of the Vulnerable Software and Affected Versions Drupal Commerce CyberSource versions 0.0.0 through 1.10.0

Description An observable timing discrepancy in the Secure Acceptance Hosted Checkout gateway integration allows for brute force attacks. The module fails to correctly verify the integrity of data returned by the payment provider, which could enable an attacker to use a timing attack to trick the site into registering a payment as received when it has not been.

Recommendations Update Drupal Commerce CyberSource to a version later than 1.10.0.