The Monobank payment API suffers from improper verification of cryptographic signatures, enabling attackers to spoof valid signatures and modify or forge payment transactions. This flaw, identified as CWE‑347, allows an attacker to alter transaction data or create new payments that the system will accept as legitimate, potentially leading to unauthorized fund transfers or fraudulent activity.

The vulnerability affects the Drupal Monobank payment API product. All versions from 0.0.0 through 1.0.3 are impacted. No specific patched version is listed in the input.

The EPSS score is < 1%, indicating a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, so official exploitation data is limited. However, the nature of the flaw means that if an attacker can obtain or guess the signing key or algorithm, they can craft requests that bypass authentication checks. The likely attack vector is the API endpoint that accepts transaction data, where signature verification is performed after the request reaches the application. The CVSS score of 3.7 classifies the vulnerability as low severity, but the potential financial impact remains significant. Given the absence of publicly known mitigations in this advisory, the risk can be considered high for environments that expose the affected API.