—

DRUPAL-CONTRIB-2025-067

Details

This module enables you to pay for Commerce order to an environment provided and secured by the bank

The module doesn't sufficiently verify the payment status on canceled orders. An attacker can issue a specially crafted request to update the order status to completed.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist:https://packages.drupal.org/8/drupal/commerce_alphabank_redirect

Introduced in: 0Fixed in: 1.0.3

Upgrade drupal/commerce_alphabank_redirect to 1.0.3 or newer (ecosystem packagist:https://packages.drupal.org/8).

References

https://www.drupal.org/sa-contrib-2025-067[WEB]