Mollie Craft Commerce webhook authentication bypass (CVE-2026-115937)

The Mollie integration for Craft Commerce contains a critical flaw (CVE-2026-115937) in its webhook endpoint. The endpoint fails to verify that the commerceTransactionHash and id parameters are cryptographically or logically bound to each other. An unauthenticated attacker possessing a valid Mollie payment ID from the merchant's account can pair it with the transaction hash of any other pending order. The system queries Mollie for the status of the supplied payment ID, receives a 'paid' status, and subsequently marks the target transaction as fully paid, regardless of the actual amount remitted.

Impact

Successful exploitation allows for improper order fulfillment by enabling attackers to complete transactions without submitting valid payment for those specific orders. This can result in unauthorized receipt of goods or services.

Recommendation

1. Identify all instances of Craft Commerce utilizing the Mollie integration.
2. Audit webhook traffic logs for recurring patterns of mismatched transaction hashes and payment IDs.
3. Monitor for and apply patches provided by the plugin maintainers to enforce parameter validation between the transaction hash and the payment ID.
4. Review commerce logs for transactions marked as 'paid' that lack corresponding legitimate payment records.