Authentication Bypass in Mollie Webhook via Parameter Manipulation

Publication date: 2026-10-23

Last updated on: 2026-10-23

Assigner: Hackrate

Description

The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: * commerceTransactionHash — selects which Craft Commerce transaction is completed * id — selects which Mollie payment is queried for its status An unauthenticated attacker holding any paid Mollie payment ID from the merchant’s account can pair it with any transaction hash. Commerce queries Mollie, sees status: paid, and marks the target transaction successful for that transaction’s full amount, regardless of how much was actually paid.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-23

Last Modified

2026-10-23

Generated

2026-10-24

AI Q&A

2026-10-24

EPSS Evaluated

N/A

NVD

CVE-2026-115937

Affected Vendors & Products

Vendor	Product	Version / Range
craftcms	commerce-mollie	2.1.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

Executive Summary

The Mollie webhook endpoint has a flaw where it accepts two attacker-controlled parameters without verifying their relationship. The parameters are commerceTransactionHash (selects a Craft Commerce transaction) and id (selects a Mollie payment ID). An unauthenticated attacker can pair any paid Mollie payment ID with any transaction hash, tricking the system into marking a transaction as successful for its full amount regardless of the actual payment.

Impact Analysis

This vulnerability allows attackers to manipulate transaction statuses, causing financial losses by marking unpaid transactions as paid. Merchants using Mollie with Craft Commerce may receive incorrect payment confirmations, leading to unfulfilled orders or chargebacks.

Mitigation Strategies

Update the Mollie webhook endpoint to validate that the commerceTransactionHash and id parameters belong together before processing payments. Ensure the system verifies transaction status directly with Mollie using a secure, authenticated API call.

Hi! I’m here to help you understand CVE-2026-115937. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70