CVE-2026-122069: Composer/drupal/basket_paypal vulnerability

Q: Who is exposed to this issue?

Sites using the AlternativeCommerce PayPal Checkout module are exposed if they accept its PayPal webhook requests. The affected package is composer/drupal/basket_paypal.

Q: What does an attacker need to exploit it?

An attacker does not need authentication. They need to submit a crafted PayPal webhook request that references a payment record.

Q: What is the impact of successful exploitation?

The order associated with the referenced payment record can be marked as paid even though no payment was completed.

Published Nov 4, 2026

Updated

The AlternativeCommerce PayPal Checkout module provides an AlternativeCommerce method to embed payment services from PayPal.

The module does not sufficiently validate incoming PayPal webhook requests. An unauthenticated attacker can submit a crafted request that references a payment record, causing the associated order to be marked as paid without completing a payment.

Affected Software

1 affected componentFixes available

composer/drupal/basket_paypal<1.1.1

1.1.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/basket_paypal to a version that resolves this vulnerability.
Fixed in 1.1.1

Event History

Nov 4, 2026

Advisory Published

via OSV·05:33 PM

Data Sourced

via OSV·05:33 PM

DescriptionAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Sites using the AlternativeCommerce PayPal Checkout module are exposed if they accept its PayPal webhook requests. The affected package is composer/drupal/basket_paypal.

What does an attacker need to exploit it?

An attacker does not need authentication. They need to submit a crafted PayPal webhook request that references a payment record.

What is the impact of successful exploitation?