The vulnerability is an improper verification of cryptographic signatures in the Drupal Commerce Stripe module, identified as CWE-347. The flaw allows attackers to craft payment requests with forged signatures, bypassing verification checks. This could enable unauthorized transaction processing and result in financial loss or fraudulent chargebacks.

Drupal Commerce Stripe modules are affected, specifically those with versions ranging from 0.0.0 to 1.4 and from 2.0.0 to 2.2.3. Any Drupal site deploying Commerce Stripe within these version ranges is potentially vulnerable.

While no CVSS score is listed, the CVE description refers to the vulnerability as moderately critical and there is no exploitation data reported in EPSS or the CISA KEV catalog. The specific attack vector is not detailed in the CVE data; however, because the flaw involves signature verification for Stripe payment processing, it is reasonable to infer that an attacker could target the payment endpoint remotely via HTTP requests. This inference is based on the component’s function and not on explicit confirmation. If a malicious actor forges a signature, they could initiate unauthorized payments, leading to financial loss and potential chargebacks.