CVE-2025-48446: Drupal Commerce Alphabank Redirect Incorrect Authorization Vulnerability
Summary
CVE-2025-48446: Drupal Commerce Alphabank Redirect Incorrect Authorization vulnerability. Affects drupal/commerce_alphabank_redirect versions < 1.0.3. Fixed in 1.0.3. How to fix ↓
Also tracked for
- drupal/commerce_alphabank_redirect · Packagist:https://packages.drupal.org/8
The same CVE-2025-48446 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Drupal Commerce Alphabank Redirect is a payment gateway integration for Drupal Commerce that facilitates transactions through Alphabank. It allows merchants to accept payments seamlessly. However, this package has been found to have an Incorrect Authorization vulnerability that could lead to functionality misuse, affecting the security of transactions processed through it.
Vulnerability Detail
The Incorrect Authorization vulnerability in Drupal Commerce Alphabank Redirect arises from improper access controls, allowing unauthorized users to exploit the functionality of the payment gateway. This can lead to unauthorized transactions or manipulation of payment processes, posing significant risks to both merchants and customers. The vulnerability affects versions from 0.0.0 up to, but not including, 1.0.3, and is classified under CWE-863, indicating a failure in enforcing proper authorization mechanisms.
How To Fix
Minimum fixed version
1.0.3
This is the first release that contains the fix.
composer require drupal/commerce_alphabank_redirect:1.0.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict access to the payment gateway functionality until the package is updated. This can be done by modifying user permissions in the Drupal admin interface to limit access to authorized users only.
Conclusion
The Incorrect Authorization vulnerability in Drupal Commerce Alphabank Redirect poses significant risks to payment processing security. It is crucial for users of affected versions to update to the latest version to mitigate these risks. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for drupal/commerce_alphabank_redirect →
FAQ
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
Versions from 0.0.0 up to, but not including, 1.0.3 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The potential consequences include unauthorized transactions and manipulation of payment processes, which can lead to financial loss and damage to reputation.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the composer.lock file.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
