SA-CONTRIB-2026-130: Critical severity drupal/monobank vulnerability
The Monobank payment API module provides integration with Monobank acquiring payments. The module did not verify the Monobank webhook signature before processing payment status callbacks.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/monobankto a version that resolves this vulnerability.Fixed in 1.0.3
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker would need to send a payment status callback to the module's webhook endpoint. Because the webhook signature was not verified, the callback could be processed without proving it came from Monobank.
Who is exposed?
Drupal sites using the Monobank payment API module and accepting Monobank payment status callbacks are exposed. The provided information does not identify affected versions or whether any configuration changes are required.
How can I determine whether my site is affected?
Check whether the site uses the drupal/monobank module for Monobank acquiring payments and processes Monobank webhook callbacks. The advisory states that signature verification was absent before payment status callbacks were processed.