CVE-2026-118558

Name of the Vulnerable Software and Affected Versions Drupal Commerce Stripe versions 2.0.0 through 2.2.3

Description A Cross-Site Request Forgery (CSRF) issue exists in the module used for Stripe Connect API integration. When redirecting to Stripe Connect to generate an authorization code, the module fails to include a CSRF token in the return URI. This allows an attacker to deceive an administrator into clicking a link that bypasses the payment process, resulting in orders being marked as paid without actual payment being processed.

Recommendations Update Drupal Commerce Stripe to a version later than 2.2.3.