CVE-2026-124624 · Other
NO FIX YET
PipraPay 3.0.0 has a weakness in the pp-token anti-CSRF handler, where the hash_hmac function in pp-content/pp-include/pp-adapter.php uses hard-coded credentials. A remote attacker who knows those credentials can forge tokens, and a public exploit has been released.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running PipraPay 3.0.0 that use its pp-token anti-CSRF handler are exposed, because the token signing key is hard-coded in pp-adapter.php. Installations on other versions, or that do not use PipraPay, are not covered by the sources. The project has not responded to the early report, so no patched release is stated.
Not affected if not-installed, other-version
Who cares payments, php, piprapay
pp-content/pp-include/pp-adapter.php exists in your PipraPay install and contains a hash_hmac function with a hard-coded key.3.0.0.No fix yet, per the sources.
A weakness has been identified in PipraPay 3.0.0. Affected by this vulnerability is the function hash_hmac of the file pp-content/pp-include/pp-adapter.php of the component pp-token anti-CSRF Handler. Executing a manipulation can lead to hard-coded credentials. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.