{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"11.6.1"}],"component":"pay","cve_ids":["CVE-2026-70658"],"ecosystem":"RubyGems","epss":0.00578,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-mjgf-xj26-9qf9","id":"tcs_01M5KEM8XS5TR1BTXR9GB2EWBW","modified_at":"2026-09-15T03:56:00.408562725Z","published_at":"2026-07-01T18:57:02Z","references":["https://osv.dev/vulnerability/GHSA-mjgf-xj26-9qf9","https://github.com/pay-rails/pay/security/advisories/GHSA-mjgf-xj26-9qf9","https://github.com/pay-rails/pay"],"severity":{"label":"high","score":7.4},"sources":[{"source":"osv","source_id":"GHSA-mjgf-xj26-9qf9","url":"https://osv.dev/vulnerability/GHSA-mjgf-xj26-9qf9"}],"summary":"pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier"}