View online: https://www.drupal.org/sa-contrib-2026-263 Project: Commerce Stripe [1] Project machine name: commerce_stripe Date: 2026-September-04 Security risk: *Critical* 15 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross-site request forgery Affected versions: >=2.0.0 <2.2.3 CVE IDs: CVE-2026-118558 Description: This module enables you to use the Stripe Connect API to quickly configure your Drupal Commerce store to take payments via multiple Stripe APIs. When redirecting to Stripe Connect to generate an authorization code, the module does not incorporate a CSRF token into the return URI. This could allow a an attacker to trick an administrator to click a link that bypasses Stripe payment for an order, meaning that the order would be marked as paid without any actual payment. Solution: Install the latest version: * Upgrade to Commerce Stripe 2.2.3 [3]. * Commerce Stripe 2.0.x and 2.1.x are no longer supported, so sites on older versions should also update to Commerce Stripe 2.2.3. * Commerce Stripe 8.x-1.x is not affected. Reported By: * Brian Willows (hsjbrianwillows) [4] Fixed By: * Ryan Szrama (rszrama) [5] * Tom Ashe (tomtech) [6] * Jonathan Sacksick (jsacksick) [7] Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team * Jess (xjm) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/commerce_stripe [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/commerce_stripe/releases/2.2.3 [4] https://www.drupal.org/u/hsjbrianwillows [5] https://www.drupal.org/u/rszrama [6] https://www.drupal.org/u/tomtech [7] https://www.drupal.org/u/jsacksick [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/poker10 [11] https://www.drupal.org/u/xjm [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....