PT-2026-130587
CVE-2026-118558
·
Published
2026-10-28
·
Updated
2026-10-30
Description by
Score
N/A
Not availableNo severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
Drupal Commerce Stripe versions 2.0.0 through 2.2.3
Description
A Cross-Site Request Forgery (CSRF) issue exists in the module used for Stripe Connect API integration. When redirecting to Stripe Connect to generate an authorization code, the module fails to include a CSRF token in the return URI. This allows an attacker to deceive an administrator into clicking a link that bypasses the payment process, resulting in orders being marked as paid without actual payment being processed.
Recommendations
Update Drupal Commerce Stripe to a version later than 2.2.3.
Found an issue in the description? Have something to add? Feel free to write us 👾