Improper Verification of Cryptographic Signature in Pay - #VU162593
Published: November 9, 2026
Vulnerability identifier: #VU162593
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-347
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to forge Lemon Squeezy webhook events and create fake subscription and order records in Pay applications.
The vulnerability exists due to Pay's Lemon Squeezy webhook controller using an empty HMAC key when the signing secret is absent from environment configuration and Rails credentials. An unauthenticated remote attacker can submit events signed with that key to /pay/webhooks/lemon_squeezy when the lemonsqueezy gem is installed, bypassing signature verification.
Affected software
Pay
Remediation
Install security update from vendor's website.
Pay - update to 12.1.1