The flaw originates from the use of a hard‑coded secret key in the PHP hash_hmac function within pp-adapter.php, a component that manages anti‑CSRF tokens. By manipulating request data, an attacker can exploit this weakness to reveal the hard‑coded credentials used to sign token data. Consequently, an adversary could forge authentication tokens or bypass security checks, leading to unauthorized access and compromising both confidentiality and integrity of the application.

The affected product is PipraPay, specifically version 3.0.0, through the pp-token anti‑CSRF handler located at pp-content/pp-include/pp-adapter.php. No other versions or variants are listed as vulnerable.

The CVSS score of 6.9 indicates moderate severity, but the EPSS score is not available, so the exact likelihood of exploitation is uncertain. The vulnerability can be triggered from a remote location, and publicly available proof‑of‑concept code demonstrates that an attacker can obtain the hard‑coded key and exploit it for credential forgery or session hijacking. Despite its significance, the flaw is not currently listed in the CISA KEV catalog.