DRUPAL-CONTRIB-2026-263: CSRF
This module enables you to use the Stripe Connect API to quickly configure your Drupal Commerce store to take payments via multiple Stripe APIs.
When redirecting to Stripe Connect to generate an authorization code, the module does not incorporate a CSRF token into the return URI. This could allow a an attacker to trick an administrator to click a link that bypasses Stripe payment for an order, meaning that the order would be marked as paid without any actual payment.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/commerce_stripeto a version that resolves this vulnerability.Fixed in 2.2.3
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue applies to deployments using the Drupal Commerce Stripe module’s Stripe Connect authorization-code flow. The vulnerable behavior occurs when the module redirects to Stripe Connect and builds the return URI without a CSRF token.
What does an attacker need to do to exploit it?
An attacker needs to trick an administrator into clicking a link. The described attack bypasses Stripe payment processing for an order.
What is the resulting impact on an affected order?
An affected order can be marked as paid even though no actual payment was made.