PYSEC-2023-1
No scoreFix available
Adyen has utility methods for validating notification HMAC signatures. The is_valid_hmac and is_valid_hmac_notification methods are vulnerable to a timing attack, you should compare the hash of the HMACs instead.
What each source reports
OSV No score
Adyen has utility methods for validating notification HMAC signatures. The is_valid_hmac and is_valid_hmac_notification methods are vulnerable to a timing attack, you should compare the hash of the HMACs instead.
- Record
PYSEC-2023-1- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
adyenPyPI |
2.2.0 up to 7.1.0, plus listed versions 2.3.03.0.03.1.04.0.05.0.05.1.06.0.07.0.0 |
7.1.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
PYSEC-2023-1 is a vulnerability with no CVSS score yet in adyen, published January 24, 2023. No source lists public exploit code. Fixed in adyen 7.1.0.