The Drupal Commerce Stripe module allows payment processing via multiple Stripe APIs. A vulnerability exists where the module does not sufficiently verify the cryptographic signature of webhook events if the webhook signing secret is not properly configured. This issue is mitigated if a webhook signing secret is set or if the payment gateway plugin does not use webhooks. Fixed versions 1.4.0 and 2.2.3 address this vulnerability.