Mollie - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/mollie/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 24 Oct 2026 00:03:43 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMollie Craft Commerce webhook authentication bypass (CVE-2026-115937)https://feed.craftedsignal.io/briefs/2026-10-mollie-craft-commerce-auth-bypass/Sat, 24 Oct 2026 00:03:43 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-mollie-craft-commerce-auth-bypass/An authentication bypass vulnerability in the Craft Commerce Mollie integration allows unauthenticated attackers to mark arbitrary transactions as paid by manipulating webhook parameters.The Mollie integration for Craft Commerce contains a critical flaw (CVE-2026-115937) in its webhook endpoint. The endpoint fails to verify that the commerceTransactionHash and id parameters are cryptographically or logically bound to each other. An unauthenticated attacker possessing a valid Mollie payment ID from the merchant's account can pair it with the transaction hash of any other pending order. The system queries Mollie for the status of the supplied payment ID, receives a 'paid' status, and subsequently marks the target transaction as fully paid, regardless of the actual amount remitted.

Impact

Successful exploitation allows for improper order fulfillment by enabling attackers to complete transactions without submitting valid payment for those specific orders. This can result in unauthorized receipt of goods or services.

Recommendation

  1. Identify all instances of Craft Commerce utilizing the Mollie integration.
  2. Audit webhook traffic logs for recurring patterns of mismatched transaction hashes and payment IDs.
  3. Monitor for and apply patches provided by the plugin maintainers to enforce parameter validation between the transaction hash and the payment ID.
  4. Review commerce logs for transactions marked as 'paid' that lack corresponding legitimate payment records.
]]>highadvisoryweb-applicationauthentication-bypasscommerce-vulnerability