Threats tagged 'drupal-contrib-2026-263'

The Drupal Commerce Stripe module versions 2.0.0 up to but not including 2.2.3 lack a CSRF token in the return URI when redirecting to Stripe Connect for authorization code generation. This vulnerability could allow an attacker to trick an administrator into clicking a malicious link that bypasses Stripe payment for an order, causing the order to be marked as paid without actual payment. A fix is available in version 2.2.3.