DRUPAL-CONTRIB-2026-333: Composer/drupal/commerce_sermepa vulnerability

Q: Who is exposed to this issue?

Drupal Commerce deployments using the Commerce sermpea module for Spanish bank payments through Sermepa/Redsys are exposed.

Q: What condition enables exploitation?

An attacker needs a Redsys payment response that can be processed against a different order, because the module does not verify that the response belongs to the order being updated.

Q: What is the potential impact?

A payment response may be applied to the wrong order, resulting in an incorrect payment status for that order.

Published Nov 11, 2026

Updated

The Commerce sermpea module provides Commerce support for Spanish banks that use Sermepa/Redsys systems.

The module does not verify that a Redsys payment response belongs to the order it is processed for, which can lead to incorrect order payment status.

Affected Software

1 affected componentFixes available

composer/drupal/commerce_sermepa<2.5.0

2.5.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/commerce_sermepa to a version that resolves this vulnerability.
Fixed in 2.5.0

Event History

Nov 11, 2026

Advisory Published

via OSV·06:01 PM

Data Sourced

via OSV·06:01 PM

DescriptionAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Drupal Commerce deployments using the Commerce sermpea module for Spanish bank payments through Sermepa/Redsys are exposed.

What condition enables exploitation?

An attacker needs a Redsys payment response that can be processed against a different order, because the module does not verify that the response belongs to the order being updated.

What is the potential impact?

A payment response may be applied to the wrong order, resulting in an incorrect payment status for that order.

DRUPAL-CONTRIB-2026-333: Composer/drupal/commerce_sermepa vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What condition enables exploitation?

What is the potential impact?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What condition enables exploitation?

What is the potential impact?