Improper Verification of Cryptographic Signature in Pay - #VU162592
Published: November 9, 2026
Vulnerability identifier: #VU162592
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-347
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to create, modify, or cancel subscription and transaction records in Pay applications.
The vulnerability exists due to the Paddle Billing controller converting a missing signing secret into an empty HMAC key when the Paddle integration is enabled and neither PADDLE_BILLING_SIGNING_SECRET nor Rails credentials provide the secret. An unauthenticated remote attacker can submit webhook events signed with this empty key to /pay/webhooks/paddle_billing, bypassing signature verification and injecting forged events into billing processing.
Affected software
Pay
Remediation
Install security update from vendor's website.
Pay - update to 12.1.1