pay vulnerabilities

1 known vulnerability in pay from Pay-rails. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.4 High severity

  pay: Observable Timing Discrepancy

  CVE-2026-70658Sep 14, 2026Pay-rails

  Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingController#valid_signature? in app/controllers/pay/webhooks/paddle_billing_controller.rb compares the computed 64-character SHA-256 HMAC with the attacker-c