Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
4 vulnerabilities by pay-rails
CVE-2026-70658 (GCVE-0-2026-70658)
Vulnerability from nvd – Published: 2026-09-14 17:14 – Updated: 2026-09-14 18:57
VLAI
EPSS
VEX
Title
pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier
Summary
Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingController#valid_signature? in app/controllers/pay/webhooks/paddle_billing_controller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the Paddle-Signature header using Ruby String#==. An unauthenticated remote attacker who can repeatedly submit requests to /pay/webhooks/paddle_billing and obtain sufficiently precise timing measurements can infer matching digest prefixes and recover a valid signature. A forged accepted webhook is enqueued through Pay::Webhooks::ProcessJob and can cause a host application to update billing state, provision paid features, record refunds, or trigger customer notifications. This issue is fixed in version 11.6.2.
Severity
7.4 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 18:57 UTC
CWE
- CWE-208 - Observable Timing Discrepancy
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pay-rails/pay/security/advisor… | x_refsource_CONFIRM |
| https://github.com/pay-rails/pay/commit/ba6494109… | x_refsource_MISC |
| https://github.com/pay-rails/pay/releases/tag/v11.6.2 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70658",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T18:57:23.905589Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T18:57:30.947Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/pay-rails/pay/security/advisories/GHSA-mjgf-xj26-9qf9"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pay",
"vendor": "pay-rails",
"versions": [
{
"status": "affected",
"version": "\u003c 11.6.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingController#valid_signature? in app/controllers/pay/webhooks/paddle_billing_controller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the Paddle-Signature header using Ruby String#==. An unauthenticated remote attacker who can repeatedly submit requests to /pay/webhooks/paddle_billing and obtain sufficiently precise timing measurements can infer matching digest prefixes and recover a valid signature. A forged accepted webhook is enqueued through Pay::Webhooks::ProcessJob and can cause a host application to update billing state, provision paid features, record refunds, or trigger customer notifications. This issue is fixed in version 11.6.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-208",
"description": "CWE-208: Observable Timing Discrepancy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T17:14:57.207Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pay-rails/pay/security/advisories/GHSA-mjgf-xj26-9qf9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pay-rails/pay/security/advisories/GHSA-mjgf-xj26-9qf9"
},
{
"name": "https://github.com/pay-rails/pay/commit/ba6494109d88209fba2a4df2d9d6373fe81ed805",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pay-rails/pay/commit/ba6494109d88209fba2a4df2d9d6373fe81ed805"
},
{
"name": "https://github.com/pay-rails/pay/releases/tag/v11.6.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pay-rails/pay/releases/tag/v11.6.2"
}
],
"source": {
"advisory": "GHSA-mjgf-xj26-9qf9",
"discovery": "UNKNOWN"
},
"title": "pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70658",
"datePublished": "2026-09-14T17:14:57.207Z",
"dateReserved": "2026-08-04T21:48:08.613Z",
"dateUpdated": "2026-09-14T18:57:30.947Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-30614 (GCVE-0-2023-30614)
Vulnerability from nvd – Published: 2023-04-19 17:28 – Updated: 2025-02-05 16:55
VLAI
EPSS
VEX
Title
Improper Neutralization of Script-Related HTML Tags in a Web Page in pay
Summary
Pay is a payments engine for Ruby on Rails 6.0 and higher. In versions prior to 6.3.2 a payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL could be distributed via email to specifically target certain individuals. If the targeted application contains a functionality to submit user-generated content (such as comments) the attacker could even distribute the URL using that functionality. This has been patched in version 6.3.2 and above. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-05 16:55 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/pay-rails/pay/security/advisor… | x_refsource_CONFIRM |
| https://github.com/pay-rails/pay/commit/5d6283a24… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T14:28:52.032Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/pay-rails/pay/security/advisories/GHSA-cqf3-vpx7-rxhw",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/pay-rails/pay/security/advisories/GHSA-cqf3-vpx7-rxhw"
},
{
"name": "https://github.com/pay-rails/pay/commit/5d6283a24062bd272a524ec48415f536a67ad57f",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/pay-rails/pay/commit/5d6283a24062bd272a524ec48415f536a67ad57f"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-30614",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-05T16:55:33.359711Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-05T16:55:39.522Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pay",
"vendor": "pay-rails",
"versions": [
{
"status": "affected",
"version": "\u003c 6.3.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Pay is a payments engine for Ruby on Rails 6.0 and higher. In versions prior to 6.3.2 a payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL could be distributed via email to specifically target certain individuals. If the targeted application contains a functionality to submit user-generated content (such as comments) the attacker could even distribute the URL using that functionality. This has been patched in version 6.3.2 and above. Users are advised to upgrade. There are no known workarounds for this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-04-19T17:28:30.937Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pay-rails/pay/security/advisories/GHSA-cqf3-vpx7-rxhw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pay-rails/pay/security/advisories/GHSA-cqf3-vpx7-rxhw"
},
{
"name": "https://github.com/pay-rails/pay/commit/5d6283a24062bd272a524ec48415f536a67ad57f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pay-rails/pay/commit/5d6283a24062bd272a524ec48415f536a67ad57f"
}
],
"source": {
"advisory": "GHSA-cqf3-vpx7-rxhw",
"discovery": "UNKNOWN"
},
"title": "Improper Neutralization of Script-Related HTML Tags in a Web Page in pay"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-30614",
"datePublished": "2023-04-19T17:28:30.937Z",
"dateReserved": "2023-04-13T13:25:18.831Z",
"dateUpdated": "2025-02-05T16:55:39.522Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-70658 (GCVE-0-2026-70658)
Vulnerability from cvelistv5 – Published: 2026-09-14 17:14 – Updated: 2026-09-14 18:57
VLAI
EPSS
VEX
Title
pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier
Summary
Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingController#valid_signature? in app/controllers/pay/webhooks/paddle_billing_controller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the Paddle-Signature header using Ruby String#==. An unauthenticated remote attacker who can repeatedly submit requests to /pay/webhooks/paddle_billing and obtain sufficiently precise timing measurements can infer matching digest prefixes and recover a valid signature. A forged accepted webhook is enqueued through Pay::Webhooks::ProcessJob and can cause a host application to update billing state, provision paid features, record refunds, or trigger customer notifications. This issue is fixed in version 11.6.2.
Severity
7.4 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 18:57 UTC
CWE
- CWE-208 - Observable Timing Discrepancy
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pay-rails/pay/security/advisor… | x_refsource_CONFIRM |
| https://github.com/pay-rails/pay/commit/ba6494109… | x_refsource_MISC |
| https://github.com/pay-rails/pay/releases/tag/v11.6.2 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70658",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T18:57:23.905589Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T18:57:30.947Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/pay-rails/pay/security/advisories/GHSA-mjgf-xj26-9qf9"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pay",
"vendor": "pay-rails",
"versions": [
{
"status": "affected",
"version": "\u003c 11.6.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingController#valid_signature? in app/controllers/pay/webhooks/paddle_billing_controller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the Paddle-Signature header using Ruby String#==. An unauthenticated remote attacker who can repeatedly submit requests to /pay/webhooks/paddle_billing and obtain sufficiently precise timing measurements can infer matching digest prefixes and recover a valid signature. A forged accepted webhook is enqueued through Pay::Webhooks::ProcessJob and can cause a host application to update billing state, provision paid features, record refunds, or trigger customer notifications. This issue is fixed in version 11.6.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-208",
"description": "CWE-208: Observable Timing Discrepancy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T17:14:57.207Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pay-rails/pay/security/advisories/GHSA-mjgf-xj26-9qf9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pay-rails/pay/security/advisories/GHSA-mjgf-xj26-9qf9"
},
{
"name": "https://github.com/pay-rails/pay/commit/ba6494109d88209fba2a4df2d9d6373fe81ed805",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pay-rails/pay/commit/ba6494109d88209fba2a4df2d9d6373fe81ed805"
},
{
"name": "https://github.com/pay-rails/pay/releases/tag/v11.6.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pay-rails/pay/releases/tag/v11.6.2"
}
],
"source": {
"advisory": "GHSA-mjgf-xj26-9qf9",
"discovery": "UNKNOWN"
},
"title": "pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70658",
"datePublished": "2026-09-14T17:14:57.207Z",
"dateReserved": "2026-08-04T21:48:08.613Z",
"dateUpdated": "2026-09-14T18:57:30.947Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-30614 (GCVE-0-2023-30614)
Vulnerability from cvelistv5 – Published: 2023-04-19 17:28 – Updated: 2025-02-05 16:55
VLAI
EPSS
VEX
Title
Improper Neutralization of Script-Related HTML Tags in a Web Page in pay
Summary
Pay is a payments engine for Ruby on Rails 6.0 and higher. In versions prior to 6.3.2 a payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL could be distributed via email to specifically target certain individuals. If the targeted application contains a functionality to submit user-generated content (such as comments) the attacker could even distribute the URL using that functionality. This has been patched in version 6.3.2 and above. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-05 16:55 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/pay-rails/pay/security/advisor… | x_refsource_CONFIRM |
| https://github.com/pay-rails/pay/commit/5d6283a24… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T14:28:52.032Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/pay-rails/pay/security/advisories/GHSA-cqf3-vpx7-rxhw",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/pay-rails/pay/security/advisories/GHSA-cqf3-vpx7-rxhw"
},
{
"name": "https://github.com/pay-rails/pay/commit/5d6283a24062bd272a524ec48415f536a67ad57f",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/pay-rails/pay/commit/5d6283a24062bd272a524ec48415f536a67ad57f"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-30614",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-05T16:55:33.359711Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-05T16:55:39.522Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pay",
"vendor": "pay-rails",
"versions": [
{
"status": "affected",
"version": "\u003c 6.3.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Pay is a payments engine for Ruby on Rails 6.0 and higher. In versions prior to 6.3.2 a payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL could be distributed via email to specifically target certain individuals. If the targeted application contains a functionality to submit user-generated content (such as comments) the attacker could even distribute the URL using that functionality. This has been patched in version 6.3.2 and above. Users are advised to upgrade. There are no known workarounds for this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-04-19T17:28:30.937Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pay-rails/pay/security/advisories/GHSA-cqf3-vpx7-rxhw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pay-rails/pay/security/advisories/GHSA-cqf3-vpx7-rxhw"
},
{
"name": "https://github.com/pay-rails/pay/commit/5d6283a24062bd272a524ec48415f536a67ad57f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pay-rails/pay/commit/5d6283a24062bd272a524ec48415f536a67ad57f"
}
],
"source": {
"advisory": "GHSA-cqf3-vpx7-rxhw",
"discovery": "UNKNOWN"
},
"title": "Improper Neutralization of Script-Related HTML Tags in a Web Page in pay"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-30614",
"datePublished": "2023-04-19T17:28:30.937Z",
"dateReserved": "2023-04-13T13:25:18.831Z",
"dateUpdated": "2025-02-05T16:55:39.522Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}