{"id":"CVE-2026-124624","kind":"vulnerability","aliases":["CVE-2026-124624"],"related":[],"title":"PipraPay 3.0.0: hard-coded credentials in anti-CSRF token HMAC function","description":"A weakness has been identified in PipraPay 3.0.0. Affected by this vulnerability is the function hash_hmac of the file pp-content/pp-include/pp-adapter.php of the component pp-token anti-CSRF Handler. Executing a manipulation can lead to hard-coded credentials. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.","summary":"PipraPay 3.0.0 has a weakness in the pp-token anti-CSRF handler, where the hash_hmac function in pp-content/pp-include/pp-adapter.php uses hard-coded credentials. A remote attacker who knows those credentials can forge tokens, and a public exploit has been released.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","payments","php","piprapay"],"not_affected_if":["not-installed","other-version"],"how_to_check":"- Check whether `pp-content/pp-include/pp-adapter.php` exists in your PipraPay install and contains a `hash_hmac` function with a hard-coded key.\n- Confirm your installed version with the PipraPay admin panel or project files; the affected version is `3.0.0`.","fix":null,"status":"open","published_at":"2026-11-09T14:17:16+00:00","first_seen_at":"2026-11-09T14:26:59+00:00","triaged_at":"2026-11-09T14:27:45+00:00","updated_at":"2026-11-09T14:27:45+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-09T14:27:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"PipraPay 3.0.0: hard-coded credentials in anti-CSRF token HMAC function","impact":"medium","summary":"PipraPay 3.0.0 has a weakness in the pp-token anti-CSRF handler, where the hash_hmac function in pp-content/pp-include/pp-adapter.php uses hard-coded credentials. A remote attacker who knows those credentials can forge tokens, and a public exploit has been released.","audience":"businesses","category":"other","nicknames":[],"who_cares":["piprapay","php","payments"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker forges anti-CSRF tokens and performs requests as victims","analyst_note":"Confirm the fix status and affected version range from the NVD entry or the project's repository; the sources say no response from the project yet.","how_to_check":"- Check whether `pp-content/pp-include/pp-adapter.php` exists in your PipraPay install and contains a `hash_hmac` function with a hard-coded key.\n- Confirm your installed version with the PipraPay admin panel or project files; the affected version is `3.0.0`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-version","not-installed"],"who_is_affected":"Sites running PipraPay 3.0.0 that use its pp-token anti-CSRF handler are exposed, because the token signing key is hard-coded in pp-adapter.php. Installations on other versions, or that do not use PipraPay, are not covered by the sources. The project has not responded to the early report, so no patched release is stated.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000764,"input_tokens":4590,"output_tokens":610,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124624':16A,19A '-2026':15A,18A '/pp-include/pp-adapter.php':47B,93C '3.0.0':2A,25B,77C 'affect':78C 'anti':9A,35B,101C 'anti-csrf':8A,34B,100C 'attack':55B,115C,135C 'avail':126C 'code':5A,51B,112C 'compon':96C 'content':46B,92C 'could':131C 'credenti':6A,52B,59B,113C 'csrf':10A,36B,102C 'cve':14A,17A 'earli':143C 'execut':104C 'exploit':66B,122C 'file':89C 'forg':61B 'function':13A,42B,84C 'handler':37B,103C 'hard':4A,50B,111C 'hard-cod':3A,49B,110C 'hash':40B,85C 'hmac':12A,41B,86C 'identifi':74C 'inform':139C 'issu':146C 'know':57B 'lead':108C 'made':125C 'manipul':106C 'may':116C 'payment':21B 'perform':118C 'php':22B 'piprapay':1A,23B,24B,76C 'pp':32B,45B,91C,98C 'pp-content':44B,90C 'pp-token':31B,97C 'problem':142C 'project':137C 'public':65B,129C 'releas':69B 'remot':54B,120C 'report':147C 'respond':151C 'token':11A,33B,62B,99C 'use':48B,133C 'vulner':81C 'weak':28B,71C 'yet':152C","nicknames":[],"mitigations":[],"who_affected":"Sites running PipraPay 3.0.0 that use its pp-token anti-CSRF handler are exposed, because the token signing key is hard-coded in pp-adapter.php. Installations on other versions, or that do not use PipraPay, are not covered by the sources. The project has not responded to the early report, so no patched release is stated.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","other","payments","php","piprapay"],"campaign_type":null,"search_a":"'-124624':16A,19A '-2026':15A,18A '3.0.0':2A 'anti':9A 'anti-csrf':8A 'code':5A 'credenti':6A 'csrf':10A 'cve':14A,17A 'function':13A 'hard':4A 'hard-cod':3A 'hmac':12A 'piprapay':1A 'token':11A","search_b":"'/pp-include/pp-adapter.php':47B '3.0.0':25B 'anti':35B 'anti-csrf':34B 'attack':55B 'code':51B 'content':46B 'credenti':52B,59B 'csrf':36B 'exploit':66B 'forg':61B 'function':42B 'handler':37B 'hard':50B 'hard-cod':49B 'hash':40B 'hmac':41B 'know':57B 'payment':21B 'php':22B 'piprapay':23B,24B 'pp':32B,45B 'pp-content':44B 'pp-token':31B 'public':65B 'releas':69B 'remot':54B 'token':33B,62B 'use':48B 'weak':28B","search_c":"'/pp-include/pp-adapter.php':93C '3.0.0':77C 'affect':78C 'anti':101C 'anti-csrf':100C 'attack':115C,135C 'avail':126C 'code':112C 'compon':96C 'content':92C 'could':131C 'credenti':113C 'csrf':102C 'earli':143C 'execut':104C 'exploit':122C 'file':89C 'function':84C 'handler':103C 'hard':111C 'hard-cod':110C 'hash':85C 'hmac':86C 'identifi':74C 'inform':139C 'issu':146C 'lead':108C 'made':125C 'manipul':106C 'may':116C 'perform':118C 'piprapay':76C 'pp':91C,98C 'pp-content':90C 'pp-token':97C 'problem':142C 'project':137C 'public':129C 'remot':120C 'report':147C 'respond':151C 'token':99C 'use':133C 'vulner':81C 'weak':71C 'yet':152C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T14:17:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124624","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124624","severity":null,"published_at":"2026-11-09T14:17:16+00:00","modified_at":"2026-11-09T14:17:16+00:00","first_seen_at":"2026-11-09T14:26:59+00:00","fetched_at":"2026-11-09T14:26:59+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}