View online: https://www.drupal.org/sa-contrib-2026-058 Project: Commerce Realex / Global Payments [1] Date: 2026-June-24 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access Bypass Affected versions: <3.0.2 CVE IDs: CVE-2026-13238 Description: This module enables you to take payments through the Global Payments / Realex Hosted Payment Page (HPP), either via a lightbox iframe or via a full-page redirect. When the gateway is configured with the *redirect* payment method, the module doesn't sufficiently verify the authenticity of the payment response returned by Global Payments. The *lightbox* payment method validates the signature and is not affected, so sites that use the lightbox payment method are not affected. Solution: Install the latest version: * If you use the commerce_realex module <=3.0.1, upgrade to commerce_realex 3.0.2 [3]. The redirect payment response is now cryptographically verified against the merchant shared secret . Sites that cannot update immediately should disable this payment gateway, until the update can be applied. Reported By: * Bill Seremetis (bserem) [4] Fixed By: * Bill Seremetis (bserem) [5] * Jaime Seuma (jaims-dev) [6] Coordinated By: * Greg Knaddison (greggles) [7] of the Drupal Security Team * Drew Webber (mcdruid) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185236-commerce_realex-security/-/work_items… [10] ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/commerce_realex [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/commerce_realex/releases/3.0.2 [4] https://www.drupal.org/u/bserem [5] https://www.drupal.org/u/bserem [6] https://www.drupal.org/u/jaims-dev [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/mcdruid [9] https://www.drupal.org/u/poker10 [10] https://git.drupalcode.org/security/185236-commerce_realex-security/-/work_i... [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....