SA-CONTRIB-2026-106: Critical severity drupal/commerce_cybersource vulnerability
Published Aug 26, 2026
·Updated
This module integrates Drupal Commerce with the CyberSource payment gateway. The module does not correctly verify the integrity of data returned by the payment provider. A timing attack could allow an attacker to trick the site into registering that payment has been received even if it hasn't. This issue only affects the Secure Acceptance Hosted Checkout gateway integration.
Credit
Brian Willows
Affected Software
1 affected componentFixes available
drupal/commerce_cybersource<8.x-1.10
8.x-1.10
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/commerce_cybersourceto a version that resolves this vulnerability.Fixed in 8.x-1.10
Event History
Aug 26, 2026
Advisory Published
via Drupal·12:00 AM
Data Sourced
via Drupal·12:00 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Are deployments using other CyberSource gateway integrations affected?
No. The issue only affects the Secure Acceptance Hosted Checkout gateway integration.
2
What is the security consequence of a successful attack?
An attacker could cause the site to register a payment as received when it has not actually been received.