Monobank Payment API CVE-2026-84918

Exploitation requires the target Drupal site to have the Monobank payment API module (versions before 1.0.3) installed and active as a payment integration, and the attacker must be able to deliver a payment notification/callback request whose cryptographic signature the module fails to verify correctly (CWE-347). The CVSS vector shows no authentication (PR:N) and no user interaction (UI:N), so a remote actor can attempt it, but AC:H indicates a non-trivial, unstated condition must be met - the available sources do not describe exactly what triggers the improper verification, so the precise precondition is unverified. Limiting factors: impact is confined to integrity (forged/spoofed payment confirmation), with no confidentiality or availability effect, and the module is a specialized Ukrainian-bank payment integration with limited deployment; sites already on version 1.0.3 are not affected.

All decision signals point to a low real-world priority. The input CVSS base score is 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N), reflecting a network-reachable but high-complexity flaw with no confidentiality or availability impact and only a limited integrity impact. EPSS is 0.10% (1st percentile), the vuln.today Decision label is 'monitor', the issue is not listed in CISA KEV, and no exploit or PoC reference is provided - so exploitation status is 'no public exploit identified at time of analysis'. These signals are consistent rather than conflicting: a low-impact integrity flaw in a niche Drupal contrib module, no active-exploitation evidence, and a vendor patch already available. The AC:H metric indicates the attack is not trivially repeatable, but the supplied sources do not describe the trigger mechanism, so the specific precondition behind that complexity cannot be confirmed. This is a genuinely low-urgency, 'patch on normal cycle' item, not a high-CVSS-but-overstated issue - the CVSS score itself is low and the ancillary signals agree with it.

An attacker who can send forged payment-notification traffic to a Drupal site running the Monobank payment API module crafts a request whose cryptographic signature is not properly verified, causing the site to accept a spoofed payment confirmation. Because impact is limited to integrity (C:N/I:L/A:N), the realistic outcome is acceptance of an invalid or unverified payment event rather than data theft or outage. No public exploit or PoC is identified, and the high attack complexity (AC:H) means the attacker must satisfy an unstated trigger condition.