CVE-2026-119037 Details
Description
Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty. signature_valid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty key. A secret read from an unset environment variable, or an empty entry in a list of rotated secrets, is used as is. A remote attacker can sign a forged webhook with an empty key and have it accepted as sent by GoCardless.
A vulnerability exists in Business::GoCardless versions prior to 1.01 for Perl, where the application accepts forged webhooks if the configured webhook secret is undefined or empty. The function signature_valid uses each configured secret as the HMAC key, but does not reject undefined or empty strings, both of which are treated as empty keys by Digest::SHA. This flaw allows a remote attacker to sign a fake webhook with an empty key, and have it accepted as legitimate by GoCardless.
Users can update to Business::GoCardless version 1.01 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://metacpan.org/release/LEEJO/Business-GoCardless-1.01/changes | CPANSec | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-347 | Improper Verification of Cryptographic Signature | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| Business::GoCardless | < 1.01 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | CPANSec |