VULNERABILITY INTELLIGENCE

CVE-2026-70658

CVSS score7.4 HIGH

EPSS probability0.58%

CISA KEVNot currently listed

Published2026-09-14

Last modified2026-09-30

Description

Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingController#valid_signature? in app/controllers/pay/webhooks/paddle_billing_controller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the Paddle-Signa…