{"cve":"CVE-2023-32694","nvd":{"published":"2023-05-25T15:15:09.027","modified":"2026-06-17T05:59:24.480","status":"Modified","description":"Saleor Core is a composable, headless commerce API. Saleor's `validate_hmac_signature` function is vulnerable to timing attacks. Malicious users could abuse this vulnerability on Saleor deployments having the Adyen plugin enabled in order to determine the secret key and forge fake events, this could affect the database integrity such as marking an order as paid when it is not. This issue has been patched in versions 3.7.68, 3.8.40, 3.9.49, 3.10.36, 3.11.35, 3.12.25, and 3.13.16.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","score":5.4},"cwes":["CWE-203","CWE-208"],"references":["https://github.com/saleor/saleor/commit/1328274e1a3d04ab87d7daee90229ff47b3bc35e","https://github.com/saleor/saleor/security/advisories/GHSA-3rqj-9v87-2x3f","https://github.com/saleor/saleor/commit/1328274e1a3d04ab87d7daee90229ff47b3bc35e","https://github.com/saleor/saleor/security/advisories/GHSA-3rqj-9v87-2x3f"],"products":["saleor:saleor"],"source":"nvd","synced_at":"2026-10-19T21:38:24.161619714+00:00"},"epss":{"cve":"CVE-2023-32694","score":0.00341,"percentile":0.2762,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}