PT-2026-84894

CVE-2026-84918

Published

2026-09-02

Updated

2026-10-22

Description by

CVSS 3.1

3.7

Low

MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal Monobank payment API versions 0.0.0 through 1.0.3

Description The Monobank payment API module, used for integrating Monobank acquiring payments, fails to verify the cryptographic signature of webhooks before processing payment status callbacks. This flaw allows for signature spoofing, where an attacker can forge payment notifications to trick the system into accepting fraudulent payment statuses.

Recommendations Update Drupal Monobank payment API to a version later than 1.0.3.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors