{"id":"CVE-2026-119037","kind":"vulnerability","aliases":["CVE-2026-119037"],"related":[],"title":"Business::GoCardless Perl module accepts forged webhooks with an empty secret","description":"Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty.\n\nsignature_valid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty key. A secret read from an unset environment variable, or an empty entry in a list of rotated secrets, is used as is.\n\nA remote attacker can sign a forged webhook with an empty key and have it accepted as sent by GoCardless.","summary":"Business::GoCardless before 1.01 for Perl verifies webhook signatures with each configured secret as the HMAC key, and it does not reject an undef or empty secret. An attacker who can reach the webhook endpoint can sign a forged webhook with an empty key and have it accepted as genuine GoCardless traffic.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gocardless","package","perl","webhooks"],"not_affected_if":["no-webhooks","non-empty-secret"],"how_to_check":"- Check the installed version of Business::GoCardless with `perl -MBusiness::GoCardless -e 'print $Business::GoCardless::VERSION'` and see whether it is below `1.01`.\n- Look for webhook secrets loaded from environment variables or from lists of rotated secrets that could be unset or empty.","fix":"- Business::GoCardless: move to `1.01` or later (the advisory states versions before 1.01 are affected).","status":"open","published_at":"2026-10-30T13:18:32+00:00","first_seen_at":"2026-10-30T13:30:27+00:00","triaged_at":"2026-10-30T13:32:19+00:00","updated_at":"2026-10-30T13:32:19+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T13:32:19Z","model":"claude-haiku-5-5","output":{"fix":"- Business::GoCardless: move to `1.01` or later (the advisory states versions before 1.01 are affected).","reach":"internet","title":"Business::GoCardless Perl module accepts forged webhooks with an empty secret","impact":"medium","summary":"Business::GoCardless before 1.01 for Perl verifies webhook signatures with each configured secret as the HMAC key, and it does not reject an undef or empty secret. An attacker who can reach the webhook endpoint can sign a forged webhook with an empty key and have it accepted as genuine GoCardless traffic.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","gocardless","webhooks"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"forged payment webhooks accepted as genuine GoCardless events","analyst_note":"","how_to_check":"- Check the installed version of Business::GoCardless with `perl -MBusiness::GoCardless -e 'print $Business::GoCardless::VERSION'` and see whether it is below `1.01`.\n- Look for webhook secrets loaded from environment variables or from lists of rotated secrets that could be unset or empty.","plain_action":"","needs_analyst":false,"not_affected_if":["no-webhooks","non-empty-secret"],"who_is_affected":"Teams that use Business::GoCardless in a Perl application to receive GoCardless webhooks are exposed when the webhook secret is undef or empty, for example when it comes from an unset environment variable or an empty entry in a rotated secret list. Applications that do not receive GoCardless webhooks through this module, or that always configure a non-empty secret, are not affected by this path.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00073,"input_tokens":4191,"output_tokens":622,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-119037':14A,17A '-2026':13A,16A '1.01':25B,78C 'accept':5A,69B,81C,158C 'attack':50B,145C 'busi':1A,22B,74C 'configur':33B,86C,97C 'cve':12A,15A 'digest':114C 'empti':10A,47B,64B,92C,109C,119C,131C,153C 'endpoint':56B 'entri':132C 'environ':127C 'forg':6A,60B,82C,149C 'genuin':71B 'gocardless':2A,18B,23B,72B,75C,162C 'hmac':37B,101C 'key':38B,65B,102C,120C,154C 'list':135C 'modul':4A 'noth':104C 'packag':19B 'perl':3A,20B,27B,80C 'reach':53B 'read':123C 'reject':43B,105C 'remot':144C 'rotat':137C 'secret':11A,34B,48B,88C,98C,122C,138C 'sent':160C 'sha':115C 'sign':58B,147C 'signatur':30B,93C 'string':110C 'traffic':73B 'treat':116C 'undef':45B,90C,106C 'unset':126C 'use':95C,140C 'valid':94C 'variabl':128C 'verifi':28B 'version':76C 'webhook':7A,21B,29B,55B,61B,83C,87C,150C","nicknames":[],"mitigations":[],"who_affected":"Teams that use Business::GoCardless in a Perl application to receive GoCardless webhooks are exposed when the webhook secret is undef or empty, for example when it comes from an unset environment variable or an empty entry in a rotated secret list. Applications that do not receive GoCardless webhooks through this module, or that always configure a non-empty secret, are not affected by this path.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T13:18:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119037","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119037","severity":null,"published_at":"2026-10-30T13:18:32+00:00","modified_at":"2026-10-30T13:18:32+00:00","first_seen_at":"2026-10-30T13:30:27+00:00","fetched_at":"2026-10-30T13:30:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}