SA-CONTRIB-2026-333: Critical severity composer/drupal/commerce_sermepa vulnerability
The Commerce sermpea module provides Commerce support for Spanish banks that use Sermepa/Redsys systems. The module does not verify that a Redsys payment response belongs to the order it is processed for, which can lead to incorrect order payment status.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/commerce_sermepato a version that resolves this vulnerability.Fixed in 8.x-2.5
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using the composer/drupal/commerce_sermepa module to process payments through Spanish banks using Sermepa/Redsys are exposed.
What does an attacker need to exploit it?
An attacker needs to cause a Redsys payment response to be processed for an order to which it does not belong. The provided information does not specify further prerequisites or attack steps.
What is the potential impact?
A payment response can be associated with the wrong order, which can result in an incorrect payment status for that order.