Unauthorized order completion via hard-coded payment state

Incorrect authorization in Drupal Commerce Eurobank (Redirect) before 2.1.1 allows remote attackers to complete canceled orders via crafted requests. CallbackController creates a payment with its state hard-coded to completed rather than using the callback-derived state. Exploitation requires a canceled checkout and processing of the forged callback; the order is then falsely recorded as paid and completed.