CVE-2026-118559
Commerce Stripe - Moderately critical - Improper verification of cryptographic signature - SA-CONTRIB-2026-264
Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce Stripe versions: from 0.0.0 to 1.4, from 2.0.0 to 2.2.3.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Commerce Stripe - Moderately critical - Improper verification of cryptographic signature - SA-CONTRIB-2026-264
Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce Stripe versions: from 0.0.0 to 1.4, from 2.0.0 to 2.2.3.
- Record
CVE-2026-118559- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-347
- Updated
- 2026-11-06
EUVDEUVD-2026-113508
Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce Stripe versions: from 0.0.0 to 1.4, from 2.0.0 to 2.2.3.
- Record
EUVD-2026-113508- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-w776-25r7-2258
Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows...
Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce Stripe versions: from 0.0.0 to 1.4, from 2.0.0 to 2.2.3.
- Record
GHSA-w776-25r7-2258- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-347
- Updated
- 2026-11-06
NVD
Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce Stripe versions: from 0.0.0 to 1.4, from 2.0.0 to 2.2.3.
- Record
CVE-2026-118559- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-347
- Updated
- 2026-11-06
OSV
Commerce Stripe - Moderately critical - Improper verification of cryptographic signature - SA-CONTRIB-2026-264
Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce Stripe versions: from 0.0.0 to 1.4, from 2.0.0 to 2.2.3.
- Record
CVE-2026-118559- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-347
- Updated
- 2026-11-07
OSVDRUPAL-CONTRIB-2026-264 No score
This module enables you to take payments via multiple Stripe APIs.
The module doesn't sufficiently verify the cryptographic signature of a webhook event when a signing secret has not been properly configured in the payment gateway settings.
This vulnerability is mitigated by the fact that not all payment gateway plugins in the module utilize webhooks. Furthermore, any payment gateway configuration with any value for its webhook signing secret will prevent inappropriate processing.
- Record
DRUPAL-CONTRIB-2026-264- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/commerce_stripePackagist:https://packages.drupal.org/8 |
before 1.4.0, 2.0.0 up to 2.2.3 | 1.4.02.2.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| severity | CVE List | |
| facts, severity | EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-118559 is a medium vulnerability (CVSS 5.3) in Drupal Commerce Stripe, published October 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.12%, the 2nd percentile. Fixed in drupal/commerce_stripe 1.4.0.