SA-CONTRIB-2026-264: Critical severity composer/drupal/commerce_stripe vulnerability

Q: Which deployments are exposed to inappropriate webhook processing?

Exposure is limited to payment gateway plugins that use webhooks and have no webhook signing secret configured. Any gateway configuration with a value set for its webhook signing secret prevents inappropriate processing.

Q: What must an attacker do to exploit this issue?

The attacker would need to send a webhook event to a vulnerable payment gateway configuration. The issue arises because the event's cryptographic signature is not sufficiently verified when the signing secret is not properly configured.

Q: What can be done if an update cannot be applied immediately?

Configure a webhook signing secret for every payment gateway configuration that uses webhooks. Any value for the webhook signing secret prevents the inappropriate processing described in the advisory.

Q: How can I determine whether a gateway configuration is affected?

Review each payment gateway configuration to identify whether it uses webhooks and whether its webhook signing secret is unset or improperly configured. Configurations that do not use webhooks, or that have any signing-secret value configured, are mitigated.

Published Oct 28, 2026

Updated

This module enables you to take payments via multiple Stripe APIs. The module doesn't sufficiently verify the cryptographic signature of a webhook event when a signing secret has not been properly configured in the payment gateway settings. This vulnerability is mitigated by the fact that not all payment gateway plugins in the module utilize webhooks. Furthermore, any payment gateway configuration with any value for its webhook signing secret will prevent inappropriate processing.

Credit

Brian Willows (hsjbrianwillows)

Affected Software

1 affected componentFixes available

composer/drupal/commerce_stripe<2.2.3

2.2.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/commerce_stripe to a version that resolves this vulnerability.
Fixed in 2.2.3
Configuration
Configure a value for the webhook signing secret in the payment gateway settings.
payment gateway configuration webhook signing secret = any value

Event History

Oct 28, 2026

Advisory Published

via Drupal·12:00 AM

Data Sourced

via Drupal·12:00 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-118559

Frequently Asked Questions

Which deployments are exposed to inappropriate webhook processing?

Exposure is limited to payment gateway plugins that use webhooks and have no webhook signing secret configured. Any gateway configuration with a value set for its webhook signing secret prevents inappropriate processing.

What must an attacker do to exploit this issue?

The attacker would need to send a webhook event to a vulnerable payment gateway configuration. The issue arises because the event's cryptographic signature is not sufficiently verified when the signing secret is not properly configured.

What can be done if an update cannot be applied immediately?

Configure a webhook signing secret for every payment gateway configuration that uses webhooks. Any value for the webhook signing secret prevents the inappropriate processing described in the advisory.

How can I determine whether a gateway configuration is affected?

Review each payment gateway configuration to identify whether it uses webhooks and whether its webhook signing secret is unset or improperly configured. Configurations that do not use webhooks, or that have any signing-secret value configured, are mitigated.

SA-CONTRIB-2026-264: Critical severity composer/drupal/commerce_stripe vulnerability

Credit

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are exposed to inappropriate webhook processing?

What must an attacker do to exploit this issue?

What can be done if an update cannot be applied immediately?

How can I determine whether a gateway configuration is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to inappropriate webhook processing?

What must an attacker do to exploit this issue?

What can be done if an update cannot be applied immediately?

How can I determine whether a gateway configuration is affected?