CVE-2026-115937

The Mollie webhook endpoint in Craft Commerce is vulnerable to an unauthenticated payment reuse flaw due to insufficient verification of data authenticity (CWE-345). The application fails to verify that the commerceTransactionHash and id parameters belong together. An unauthenticated attacker pos...