PT-2026-91283

Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingControllervalid signature? in app/controllers/pay/webhooks/paddle billing controller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the...