Vulnerability in Payments Engine for Ruby on Rails by Pay

CVE-2026-70658

What is CVE-2026-70658?

The Pay payments engine for Ruby on Rails versions prior to 11.6.2 contains a vulnerability in the PaddleBillingController. This flaw arises from the insecure comparison of a computed SHA-256 HMAC with an attacker-controlled token from the Paddle-Signature header, allowing an unauthenticated remote attacker to exploit this weakness. By submitting repeated requests and analyzing timing differences, an attacker can derive valid signatures, potentially enabling unauthorized actions such as altering billing states, provisioning paid features, or initiating refund requests. This vulnerability has been addressed in version 11.6.2.

References