CVE-2026-81159: CWE-208 Observable Timing Discrepancy in Drupal Commerce CyberSource

This vulnerability (CVE-2026-81159) in Drupal Commerce CyberSource is classified as CWE-208 (Observable Timing Discrepancy). It allows an attacker to perform brute force attacks by exploiting timing differences in the application's response. The affected versions range from 0.0.0 to 1.10.0 inclusive. The CVSS v3.1 base score is 3.7, indicating low severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and impact limited to integrity. There is no vendor advisory or patch information available at this time.

The vulnerability allows an attacker to conduct brute force attacks by observing timing discrepancies, potentially leading to integrity violations. There is no impact on confidentiality or availability. The overall severity is low based on the CVSS score and described impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider monitoring for unusual brute force activity and applying any recommended security best practices specific to Drupal Commerce CyberSource.