I had reported the hash collision bug via Bugcrowd (independently but after OP). Their response was they have upgraded from MD5 to SHA256 when the bug itself ha

I had reported the hash collision bug via Bugcrowd (independently but after OP). Their response was they have upgraded from MD5 to SHA256 when the bug itself has nothing to do with encryption type but rather how you construct your string. They had asked their clients to upgrade to SHA256 version of sdk saying it will provide better security than MD5 but actually in that version they sneakily updated the way they constructed the string (which was the actual problem) and no one knows about this. They should atleast be true to their customers who use their sdk for payments. Edit: My report to them: https://imgur.com/1f2jU05 https://imgur.com/1f2jU05