Live › vulnerability › CVE-2026-84918
Go to dashboardThe Drupal Monobank payment API module does not properly verify cryptographic signatures on payment messages. An attacker can forge a signature that the module accepts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Drupal Monobank payment API module at version or earlier that rely on its signature checks for payment callbacks. Sites that do not use this module can skip it. The sources do not say whether a patched version exists.
1.0.3No product ranges from the sources yet.
composer show or the Drupal extensions page) and see whether it is 1.0.3 or earlier.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. This issue affects Monobank payment API versions: from 0.0.0 to 1.0.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-84918")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.