CVE-2026-81159: Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106
Published Sep 2, 2026
·Updated
Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0.
Affected Software
2 affected components
Commerce CyberSource>=0.0.0<=1.10.0
Centarro Commerce Cybersource Drupal>=8.x-1.0<8.x-1.10
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Drupal Commerce CyberSourceto a version that resolves this vulnerability.Fixed in 1.10.0Patch SA-CONTRIB-2026-106 - Compensating control
Mitigate brute-force attempts by adding an external rate limit / brute-force protection for the Drupal site endpoints affected by the Observable Timing Discrepancy (Brute Force) until the Commerce CyberSource update is applied.
Event History
Sep 2, 2026
CVE Published
via MITRE·12:32 PM
Data Sourced
via MITRE·12:32 PM
DescriptionWeakness
Data Sourced
via NVD·01:18 PM
DescriptionSeverityWeaknessAffected Software