CVE-2026-70658

Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingController#valid_signature? in app/controllers/pay/webhooks/paddle_billing_controller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the Paddle-Signature header using Ruby String#==. An unauthenticated remote attacker who can repeatedly submit requests to /pay/webhooks/paddle_billing and obtain sufficiently precise timing measurements can infer matching digest prefixes and recover a valid signature. A forged accepted webhook is enqueued through Pay::Webhooks::ProcessJob and can cause a host application to update billing state, provision paid features, record refunds, or trigger customer notifications. This issue is fixed in version 11.6.2.

• CWE-208

• https://github.com/pay-rails/pay/commit/ba6494109d88209fba2a4df2d9d6373fe81ed805
• https://github.com/pay-rails/pay/releases/tag/v11.6.2
• https://github.com/pay-rails/pay/security/advisories/GHSA-mjgf-xj26-9qf9
• https://github.com/pay-rails/pay/security/advisories/GHSA-mjgf-xj26-9qf9

Published

Sep 14, 2026

Last Modified

Sep 14, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-70651libvips is a fast image processing library with low memory n…6.9
• CVE-2026-70652libvips is a fast image processing library with low memory n…2
• CVE-2026-70653libvips is a fast image processing library with low memory n…4.8
• CVE-2026-70654libvips is a fast image processing library with low memory n…5.8
• CVE-2026-70656Checkmate is an open-source, self-hosted tool designed to tr…4.9
• CVE-2026-70657Copyparty is a portable file server. Prior to 1.20.17, copyp…4.3
• CVE-2026-7066A vulnerability was found in choieastsea simple-openstack-mc…7.3
• CVE-2026-70665Doorkeeper OpenID Connect implements an OpenID Connect authe…4.2
• CVE-2026-70666Lemur manages TLS certificate creation. Prior to 1.9.3, an a…7.4
• CVE-2026-70667Lemur manages TLS certificate creation. Prior to 1.9.3, _val…6.3
• CVE-2026-70668Vulnerability in the Oracle Reports Developer product of Ora…9.1
• CVE-2026-70669Vulnerability in the Oracle Reports Developer product of Ora…9.8