GHSA-5957-C7QM-M469 Action Mailbox: Possible signature replay in Action Mailbox Mailgun ingress

Impact The Action Mailbox Mailgun ingress authenticates a request with an HMAC of the timestamp and token parameters concatenated without a separator, and ActionMailbox::Ingresses::Mailgun::InboundEmailsController::Authenticatorrecent? rejects only timestamps more than 2 minutes in the past...

CVE-2026-126068 Action Mailbox: Possible signature replay in Action Mailbox Mailgun ingress

Action Mailbox routes incoming emails to controller-like mailboxes for processing in Rails. Prior to 8.1.4.1 and 8.0.5.2, the Action Mailbox Mailgun ingress authenticates a request with an HMAC of the timestamp and token parameters concatenated without a separator, and...

PT-2026-144723

Name of the Vulnerable Software and Affected Versions Rails versions prior to 8.1.4.1 Rails versions prior to 8.0.5.2 Description The Action Mailbox Mailgun ingress authenticates requests using an HMAC of the timestamp and token parameters concatenated without a separator. The...

Action Mailbox: Possible signature replay in Action Mailbox Mailgun ingress

The Action Mailbox Mailgun ingress authenticates a request with an HMAC of the timestamp and token parameters concatenated without a separator, and ActionMailbox::Ingresses::Mailgun::InboundEmailsController::Authenticatorrecent? rejects only timestamps more than 2 minutes in the past. Because the...