Improper Verification of Cryptographic Signature in Drupal Commerce Stripe
CVE-2026-118559

5.3MEDIUM

Key Information:

Vendor

Drupal
Status
Commerce Stripe
Vendor
CVE Published:
30 October 2026

What is CVE-2026-118559?

The Drupal Commerce Stripe plugin is susceptible to a vulnerability that allows for Signature Spoofing due to improper verification of cryptographic signatures. This critical flaw affects multiple versions of the plugin, leaving instances open to potential exploitation. Affected versions range from 0.0.0 to 1.4 and from 2.0.0 to 2.2.3. Implementing updated security measures and patching affected versions is crucial to safeguard against this issue.

Affected Version(s)

Commerce Stripe 0.0.0 < 1.4

Commerce Stripe 2.0.0 < 2.2.3

References

https://www.drupal.org/sa-contrib-2026-264

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Brian Willows (hsjbrianwillows)
Ryan Szrama (rszrama)
Tom Ashe (tomtech)
Swan Kalata (akalata)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
Jess (xjm)
.