Timing Attack Affecting pay package, versions <11.6.2
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUBY-PAY-17756774
- published1 Jul 2026
- disclosed1 Jul 2026
- creditUnknown
Introduced: 1 Jul 2026
New CVE NOT AVAILABLE CWE-208 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade pay to version 11.6.2 or higher.
Overview
pay is a package for processing payments in Ruby on Rails apps
Affected versions of this package are vulnerable to Timing Attack via the valid_signature? function. An attacker can recover valid webhook signatures by sending multiple requests with crafted Paddle-Signature header values and measuring response times, allowing them to forge webhook events and potentially manipulate billing state.