pypi package report

Is adyen safe?

1 known vulnerability, worst severity MODERATE.

// reach

7 direct dependencies

2 carry known advisories, worst HIGH

0 packages depend on it

an advisory here reaches each of them

Create a free accountfor every dependency path, dependent and what to upgrade

// ai model usage

No published models are known to use this package.

cvss

0.0

medium

severity band, no base score published

epss

not scored

chance of exploitation in 30 days

xyz score

not scored

CyberXYZ composite out of 10

fig. 01 — GHSA-f3q4-ggfp-jv34, the advisory selected below

// 1 advisories

GHSA-f3q4-ggfp-jv34

MODERATE

Adyen has utility methods for validating notification HMAC signatures. The isvalidhmac and isvalidhmacnotification methods are vulnerable to a timing attack, you should compare the hash of the HMACs instead.

// cvss v3.1 vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: Low
Availability: None

Checked 2026-10-23 at 18:49 UTC. The most recent advisory here was published 2024-08-30. Updated continuously from NVD, GHSA, OSV and CNA feeds.