EUVD-2026-77680Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingController#valid_signature? in app/controllers/pay/webhooks/paddle_billing_controller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the Paddle-Signature header using Ruby String#==. An unauthenticated remote attacker who can repeatedly submit requests to /pay/webhooks/paddle_billing and obtain sufficiently precise timing measurements can infer matching digest prefixes and recover a valid signature. A forged accepted webhook is enqueued through Pay::Webhooks::ProcessJob and can cause a host application to update billing state, provision paid features, record refunds, or trigger customer notifications. This issue is fixed in version 11.6.2.
AnalysisAI
Timing side-channel in pay-rails Pay (≤ 11.6.1) allows unauthenticated remote attackers to recover the Paddle Billing webhook HMAC signature byte-by-byte and forge webhook events. The Pay::Webhooks::PaddleBillingController compares the computed SHA-256 HMAC against the attacker-supplied h1 header value with Ruby's non-constant-time String#==, so response timing leaks how much of the digest prefix matches. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Improper check or handling of exception conditions vulnerability in Samsung Pay (US only) prior to version 4.0.65 allows
Pay is a payments engine for Ruby on Rails 6.0 and higher. Rated medium severity (CVSS 6.1), this vulnerability is remot
Solana Pay is a protocol and set of reference implementations that enable developers to incorporate decentralized paymen
Improper export of Android application components vulnerability in Samsung Pay (India only) prior to version 4.1.77 allo
Same weakness CWE-208 – Observable Timing Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today