CVE-2026-70658

RubyGems/pay CVE-2026-70658: high 7.4, EPSS 0.58%

pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-mjgf-xj26-9qf9
• https://github.com/pay-rails/pay/security/advisories/GHSA-mjgf-xj26-9qf9
• https://github.com/pay-rails/pay

CVE-2026-70658 · published 2026-07-01T18:57:02Z · modified 2026-09-15T03:56:00.408562725Z · JSON