CVE-2026-81159
CVE-2026-81159 · Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0.
CVSS 3.7 · Low · EPSS 0.3% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
commerce cybersource
- Versions
- ≥ 0.0.0, < 1.10.0: Affected (semver)
Update to 1.10.0
drupal/commerce_cybersource Packagist:https://packages.drupal.org/8
- Affected ranges
- ECOSYSTEM: < 1.10.0
Update to 1.10.0