GHSA-f3q4-ggfp-jv34

Adyen APIs Library for Python timing attack vulnerability

6.9 MediumFix available

GHSA-f3q4-ggfp-jv34 is a medium vulnerability (CVSS 6.9) in adyen, published August 30, 2024. No source lists public exploit code. Fixed in adyen 7.1.0.

What does this mean?

Severity: 6.9 MediumCVSS 4.0, GitHub Advisories
Exploit chance: UnscoredNo EPSS score yet
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 7.1.0adyen +1 more

Description

Adyen has utility methods for validating notification HMAC signatures. The is_valid_hmac and is_valid_hmac_notification methods are vulnerable to a timing attack, you should compare the hash of the HMACs instead.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Affected packages

Affected packages
Package	Affected	Fixed
`adyen` PyPI	2.2.0 up to 7.1.0	7.1.0
`adyen` PyPI	2.2.0 up to 7.1.0, plus listed versions 2.3.03.0.03.1.04.0.05.0.05.1.06.0.07.0.0	7.1.0

What each source reports

GitHub Advisories Score used6.9

Adyen APIs Library for Python timing attack vulnerability

Record: GHSA-f3q4-ggfp-jv34
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-347
Updated: 2026-11-02

OSV6.9