Live › vulnerability › CVE-2026-118559
Drupal Commerce Stripe does not properly verify Stripe's cryptographic signature on incoming requests. An attacker can forge a signature and send fake Stripe events to the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites that run the Commerce Stripe module and accept Stripe webhook callbacks are exposed. Sites that do not use Commerce Stripe, or that run outside the listed version ranges, can skip this. The sources do not describe the exact verification step that fails.
No product ranges from the sources yet.
drupal/stripe (or the Commerce Stripe module) with composer show drupal/stripe and compare against the affected ranges.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce Stripe versions: from 0.0.0 to 1.4, from 2.0.0 to 2.2.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-118559")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.