CVE-2026-118559: Drupal Commerce Stripe improper webhook signature verification

CVE-2026-118559 · Severity: info · Published 2026-10-30

The Commerce Stripe module for Drupal processes payments through Stripe's payment gateway. When webhook signing secrets are not properly configured, the module fails to verify that payment notifications are legitimate, allowing attackers to forge fake payment events and trigger fraudulent transactions or other malicious actions.

Technologies: Drupal Commerce Stripe, Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce Stripe. Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-118559 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-118559 being exploited in the wild.
How severe is CVE-2026-118559?
Informational severity, published 30 October 2026.
Which products and versions are affected?
Drupal Commerce Stripe <1.4, >=2.0.0 <2.2.3; Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce Stripe ECOSYSTEM:introduced=0,fixed=1.4.0|ECOSYSTEM:introduced=2.0.0,fixed=2.2.3.
Is there a fix for CVE-2026-118559?
Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce Stripe: upgrade to 1.4.0 or later. Until then: Ensure all payment gateway configurations have a non-empty webhook signing secret value configured in the payment gateway settings. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118559 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-118559?
Check whether you run Drupal Commerce Stripe or Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce Stripe at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce Stripe: upgrade to 1.4.0 or later

Ensure all payment gateway configurations have a non-empty webhook signing secret value configured in the payment gateway settings.

Technical details

The module does not sufficiently verify cryptographic signatures on webhook events when a signing secret has not been configured in the payment gateway settings. This is a cryptographic verification bypass vulnerability affecting webhook processing. The risk is partially mitigated because not all payment gateway configurations use webhooks, and any non-empty signing secret value prevents the vulnerability.

Affected products

  • Drupal Commerce Stripe <1.4, >=2.0.0 <2.2.3

Identifiers

  • CVE-2026-118559
  • DRUPAL-CONTRIB-2026-264

Timeline

  • 2026-10-28: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.