---
id: CVE-2026-70658
title: Pay is a payments engine for Ruby on Rails 6.0 and higher
summary: >-
  Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2,
  Pay::Webhooks::PaddleBillingController#valid_signature? in
  app/controllers/pay/webhooks/paddle_billing_controller.rb compares the
  computed 64-character SHA-256 H…
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-208
vendor: pay-rails
product: pay
affected:
  - pay < 11.6.2
published: '2026-09-14'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T19:17:40.293'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-70658'
references:
  - url: >-
      https://github.com/pay-rails/pay/commit/ba6494109d88209fba2a4df2d9d6373fe81ed805
    label: security-advisories@github.com
  - url: 'https://github.com/pay-rails/pay/releases/tag/v11.6.2'
    label: security-advisories@github.com
  - url: 'https://github.com/pay-rails/pay/security/advisories/GHSA-mjgf-xj26-9qf9'
    label: security-advisories@github.com
  - url: 'https://github.com/pay-rails/pay/security/advisories/GHSA-mjgf-xj26-9qf9'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-14T18:57:23.905589Z'
ingestedAt: '2026-09-14T18:12:17.318Z'
epss: 0.00578
epssPercentile: 0.45203
---

## Overview

Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingController#valid_signature? in app/controllers/pay/webhooks/paddle_billing_controller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the Paddle-Signature header using Ruby String#==. An unauthenticated remote attacker who can repeatedly submit requests to /pay/webhooks/paddle_billing and obtain sufficiently precise timing measurements can infer matching digest prefixes and recover a valid signature. A forged accepted webhook is enqueued through Pay::Webhooks::ProcessJob and can cause a host application to update billing state, provision paid features, record refunds, or trigger customer notifications. This issue is fixed in version 11.6.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.