pay-rails pay up to 11.6.1 Webhook paddle_billing_controller.rb PaddleBillingController#valid_signature h1 random values

Summaryinfo

A vulnerability has been found in pay-rails pay up to 11.6.1 and classified as problematic. Affected by this vulnerability is the function Pay::Webhooks::PaddleBillingController#valid_signature of the file app/controllers/pay/webhooks/paddle_billing_controller.rb of the component Webhook. Performing a manipulation of the argument h1 results in random values. This vulnerability was named CVE-2026-70658. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic has been found in pay-rails pay up to 11.6.1. This affects the function Pay::Webhooks::PaddleBillingController#valid_signature of the file app/controllers/pay/webhooks/paddle_billing_controller.rb of the component Webhook. The manipulation of the argument h1 with an unknown input leads to a random values vulnerability. CWE is classifying the issue as CWE-330. The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers. This is going to have an impact on confidentiality. The summary by CVE is:

Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingController#valid_signature? in app/controllers/pay/webhooks/paddle_billing_controller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the Paddle-Signature header using Ruby String#==. An unauthenticated remote attacker who can repeatedly submit requests to /pay/webhooks/paddle_billing and obtain sufficiently precise timing measurements can infer matching digest prefixes and recover a valid signature. A forged accepted webhook is enqueued through Pay::Webhooks::ProcessJob and can cause a host application to update billing state, provision paid features, record refunds, or trigger customer notifications. This issue is fixed in version 11.6.2.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-70658 since 08/04/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1600.001 according to MITRE ATT&CK.

Upgrading to version 11.6.2 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• pay-rails

Name

• pay

Version

• 11.6.0
• 11.6.1

Website

• Product: https://github.com/pay-rails/pay/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion