---
id: "CVE-2026-124624"
page: "https://infrastack.ai/live/CVE-2026-124624"
kind: "vulnerability"
aliases: ["CVE-2026-124624"]
title: "PipraPay 3.0.0: hard-coded credentials in anti-CSRF token HMAC function"
severity: "medium"
cvss: 5.5
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "payments", "php", "piprapay"]
not_affected_if: ["not-installed", "other-version"]
published_at: "2026-11-09T14:17:16+00:00"
first_seen_at: "2026-11-09T14:26:59+00:00"
updated_at: "2026-11-09T14:27:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124624", "first_seen_at": "2026-11-09T14:26:59+00:00"}]
exploit_sources: []
---

# PipraPay 3.0.0: hard-coded credentials in anti-CSRF token HMAC function

Link for people: https://infrastack.ai/live/CVE-2026-124624 (this .md is for agents)

PipraPay 3.0.0 has a weakness in the pp-token anti-CSRF handler, where the hash_hmac function in pp-content/pp-include/pp-adapter.php uses hard-coded credentials. A remote attacker who knows those credentials can forge tokens, and a public exploit has been released.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether `pp-content/pp-include/pp-adapter.php` exists in your PipraPay install and contains a `hash_hmac` function with a hard-coded key.
- Confirm your installed version with the PipraPay admin panel or project files; the affected version is `3.0.0`.

## Timeline

- 2026-11-09T14:26:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124624

## From the sources

A weakness has been identified in PipraPay 3.0.0. Affected by this vulnerability is the function hash_hmac of the file pp-content/pp-include/pp-adapter.php of the component pp-token anti-CSRF Handler. Executing a manipulation can lead to hard-coded credentials. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_