{"id":"CVE-2026-118559","kind":"vulnerability","aliases":["CVE-2026-118559"],"related":[],"title":"Drupal Commerce Stripe: webhook signatures can be spoofed, versions 1.4 and 2.2.3 affected","description":"Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce Stripe versions: from 0.0.0 to 1.4, from 2.0.0 to 2.2.3.","summary":"Drupal Commerce Stripe does not properly verify Stripe's cryptographic signature on incoming requests. An attacker can forge a signature and send fake Stripe events to the site.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["commerce-stripe","drupal","package","php","stripe"],"not_affected_if":["module-not-installed","outside-affected-versions"],"how_to_check":"- Check the installed version of `drupal/stripe` (or the Commerce Stripe module) with `composer show drupal/stripe` and compare against the affected ranges.\n- Look for the Stripe webhook endpoint in the site configuration and confirm whether it is reachable from the internet.","fix":"- Commerce Stripe versions from 0.0.0 to 1.4 and from 2.0.0 to 2.2.3 are affected; the sources do not state a fixed version.","status":"open","published_at":"2026-10-30T04:18:21+00:00","first_seen_at":"2026-10-30T04:28:39+00:00","triaged_at":"2026-10-30T04:29:19+00:00","updated_at":"2026-10-30T04:29:19+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T04:29:19Z","model":"claude-haiku-5-5","output":{"fix":"- Commerce Stripe versions from 0.0.0 to 1.4 and from 2.0.0 to 2.2.3 are affected; the sources do not state a fixed version.","reach":"internet","title":"Drupal Commerce Stripe: webhook signatures can be spoofed, versions 1.4 and 2.2.3 affected","impact":"medium","summary":"Drupal Commerce Stripe does not properly verify Stripe's cryptographic signature on incoming requests. An attacker can forge a signature and send fake Stripe events to the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","commerce-stripe","stripe","php"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"forged payment events accepted by the shop, enabling order or payment tampering","analyst_note":"Confirm the fixed version and the exact verification flaw from the Drupal security advisory for Commerce Stripe; the NVD entry gives no fix.","how_to_check":"- Check the installed version of `drupal/stripe` (or the Commerce Stripe module) with `composer show drupal/stripe` and compare against the affected ranges.\n- Look for the Stripe webhook endpoint in the site configuration and confirm whether it is reachable from the internet.","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed","outside-affected-versions"],"who_is_affected":"Drupal sites that run the Commerce Stripe module and accept Stripe webhook callbacks are exposed. Sites that do not use Commerce Stripe, or that run outside the listed version ranges, can skip this. The sources do not describe the exact verification step that fails.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000729,"input_tokens":4113,"output_tokens":636,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118559':16A,19A '-2026':15A,18A '0.0.0':75C '1.4':10A,77C '2.0.0':79C '2.2.3':12A,81C 'affect':13A,70C 'allow':65C 'attack':42B 'commerc':2A,21B,28B,63C,71C 'commerce-strip':20B 'cryptograph':36B,58C 'cve':14A,17A 'drupal':1A,23B,27B,62C 'event':51B 'fake':49B 'forg':44B 'improp':55C 'incom':39B 'issu':69C 'packag':24B 'php':25B 'proper':32B 'request':40B 'send':48B 'signatur':5A,37B,46B,59C,66C 'site':54B 'spoof':8A,67C 'stripe':3A,22B,26B,29B,34B,50B,64C,72C 'verif':56C 'verifi':33B 'version':9A,73C 'vulner':60C 'webhook':4A","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that run the Commerce Stripe module and accept Stripe webhook callbacks are exposed. Sites that do not use Commerce Stripe, or that run outside the listed version ranges, can skip this. The sources do not describe the exact verification step that fails.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118559","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118559","severity":null,"published_at":"2026-10-30T04:18:21+00:00","modified_at":"2026-10-30T04:18:21+00:00","first_seen_at":"2026-10-30T04:28:39+00:00","fetched_at":"2026-10-30T04:28:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}