Project: 
AlternativeCommerce PayPal Checkout
Project machine name: 
basket_paypal
Date: 
2026-November-04
Security risk: 
Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All
Vulnerability: 
Access bypass
Affected versions: 
<1.1.1
CVE IDs: 
CVE-2026-122069
Description: 

The AlternativeCommerce PayPal Checkout module provides an AlternativeCommerce method to embed payment services from PayPal.

The module does not sufficiently validate incoming PayPal webhook requests. An unauthenticated attacker can submit a crafted request that references a payment record, causing the associated order to be marked as paid without completing a payment.

Solution: 

Install the latest version:

Reported By: 
Fixed By: 
Coordinated By: