CVE-2026-126742: Composer/drupal/commerce_sermepa vulnerability
The Commerce sermpea module provides Commerce support for Spanish banks that use Sermepa/Redsys systems.
The module does not verify that a Redsys payment response belongs to the order it is processed for, which can lead to incorrect order payment status.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/commerce_sermepato a version that resolves this vulnerability.Fixed in 2.5.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Drupal Commerce sites using the composer/drupal/commerce_sermepa module to process payments through Spanish banks that use Sermepa/Redsys systems are exposed.
What must an attacker be able to do to exploit it?
An attacker would need to cause a Redsys payment response to be processed for an order to which that response does not belong. The available information does not specify the exact request access or response-forging capabilities required.
How can administrators determine whether they are affected?
Identify whether the site has composer/drupal/commerce_sermepa installed and uses it for Sermepa/Redsys payment processing. Review payment and order records for payment responses associated with the wrong orders or unexpected order payment-status changes.