CVE-2026-84918: Monobank Payment API Module Lacks Webhook Signature Verification
Summary
CVE-2026-84918: The Monobank payment API module provides integration with Monobank acquiring payments. Affects drupal/monobank versions < 1.0.3. Fixed in 1.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Monobank payment API module is designed for integrating Monobank acquiring payments into Drupal applications. It facilitates seamless payment processing and enhances user experience by allowing transactions directly through the Monobank platform. However, the module has a critical vulnerability that compromises the security of payment status callbacks.
Vulnerability Detail
The vulnerability arises from the Monobank payment API module's failure to verify the webhook signature before processing payment status callbacks. This oversight allows malicious actors to potentially spoof payment notifications, leading to unauthorized transactions or data manipulation. The lack of signature verification can result in significant financial losses and undermine the integrity of the payment system.
How To Fix
Minimum fixed version
1.0.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability. The best course of action is to update to the latest version of the module as soon as possible.
Conclusion
The Monobank payment API module has a critical vulnerability due to the lack of webhook signature verification, which can lead to unauthorized transactions. It is imperative to update to version 1.0.3 or later to secure your application. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your software.
See every vulnerability recorded for drupal/monobank →
FAQ
It is a Drupal module that integrates Monobank acquiring payments, allowing users to process payments directly through the Monobank platform.
The vulnerability involves the module's failure to verify webhook signatures, which can lead to unauthorized payment notifications and potential financial loss.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
While there are no workarounds, it is crucial to prioritize updating the module to mitigate the risk associated with this vulnerability.
For more information, you can reach out to Marcus Johansson, who reported the vulnerability, through his Drupal profile at https://www.drupal.org/u/marcus_johansson.
