CVE-2026-70658: pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier
Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingController#validsignature? in app/controllers/pay/webhooks/paddlebillingcontroller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the Paddle-Signature header using Ruby String#==. An unauthenticated remote attacker who can repeatedly submit requests to /pay/webhooks/paddlebilling and obtain sufficiently precise timing measurements can infer matching digest prefixes and recover a valid signature. A forged accepted webhook is enqueued through Pay::Webhooks::ProcessJob and can cause a host application to update billing state, provision paid features, record refunds, or trigger customer notifications. This issue is fixed in version 11.6.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pay-rails/payto a version that resolves this vulnerability.Fixed in 11.6.2Patch pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier
Event History
Frequently Asked Questions
What conditions must an attacker meet to forge an accepted webhook?
The attacker does not need authentication, but must be able to repeatedly send requests to /pay/webhooks/paddle_billing and obtain sufficiently precise timing measurements. They use those measurements to infer matching prefixes of the SHA-256 HMAC and recover a valid signature.
What application actions could a successful forged webhook cause?
An accepted forged webhook is enqueued through Pay::Webhooks::ProcessJob. Depending on the host application's webhook handling, it can update billing state, provision paid features, record refunds, or trigger customer notifications.
Which deployments are affected and what version fixes the issue?
Pay versions prior to 11.6.2 are affected where the Paddle Billing webhook signature verifier is used. Version 11.6.2 fixes the non-constant-time signature comparison.