PT-2026-82363

CVE-2026-81159

Published

2026-08-26

Updated

2026-09-02

Description by

CVSS 3.1

3.7

Low

MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal Commerce CyberSource versions 0.0.0 through 1.10.0

Description An observable timing discrepancy in the Secure Acceptance Hosted Checkout gateway integration allows for brute force attacks. The module fails to correctly verify the integrity of data returned by the payment provider, which could enable an attacker to use a timing attack to trick the site into registering a payment as received when it has not been.

Recommendations Update Drupal Commerce CyberSource to a version later than 1.10.0.

Exploitability

Fix

Researchers