CVE-2026-118559

Name of the Vulnerable Software and Affected Versions Drupal Commerce Stripe versions 0.0.0 through 1.4 Drupal Commerce Stripe versions 2.0.0 through 2.2.3

Description Improper verification of cryptographic signatures in the module allows for signature spoofing. The issue occurs when a signing secret is not properly configured in the payment gateway settings, leading to insufficient verification of webhook event signatures. Webhooks are automated messages sent from Stripe to the application to notify it about events, such as successful payments.

Recommendations Configure a valid value for the webhook signing secret in the payment gateway settings for versions 0.0.0 through 1.4. Configure a valid value for the webhook signing secret in the payment gateway settings for versions 2.0.0 through 2.2.3.