{"id":"CVE-2026-81159","aliases":["DRUPAL-CONTRIB-2026-106","EUVD-2026-70005","GHSA-7q92-q5vc-5r4r"],"status":"published","title":"Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106","description":"Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00256,"percentile":0.1732,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-208"],"published":"2026-08-26T17:35:31Z","modified":"2026-09-16T20:19:00Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/commerce_cybersource","fixed_in":["1.10.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/commerce_cybersource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0"}]}]}],"products":[{"vendor":"centarro","product":"commerce_cybersource"},{"vendor":"drupal","product":"commerce cybersource"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-106","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81159"},{"url":"https://github.com/advisories/GHSA-7q92-q5vc-5r4r"}],"sources":{"cve":[{"id":"CVE-2026-81159","title":"Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106","description":"Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0.","status":"published","published":"2026-09-02T12:32:12.56Z","modified":"2026-09-02T18:59:22.683Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T13:36:29.327819Z"}],"euvd":[{"id":"EUVD-2026-70005","description":"Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0.","status":"published","published":"2026-09-02T12:32:12Z","modified":"2026-09-02T18:59:22Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T18:01:14.689075Z"}],"ghsa":[{"id":"GHSA-7q92-q5vc-5r4r","title":"Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force....","description":"Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0.","status":"published","published":"2026-09-02T15:34:46Z","modified":"2026-09-02T21:33:05Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T15:11:18.49317Z"}],"nvd":[{"id":"CVE-2026-81159","description":"Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0.","status":"published","published":"2026-09-02T13:18:11.653Z","modified":"2026-09-16T20:19:00.24Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T14:12:43.399612Z"}],"osv":[{"id":"DRUPAL-CONTRIB-2026-106","description":"This module integrates Drupal Commerce with the CyberSource payment gateway.\n\nThe module does not correctly verify the integrity of data returned by the payment provider. A timing attack could allow an attacker to trick the site into registering that payment has been received even if it hasn't.\n\nThis issue only affects the Secure Acceptance Hosted Checkout gateway integration.","status":"published","published":"2026-08-26T17:35:31Z","modified":"2026-08-26T22:41:58.654224Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}