Live › vulnerability › CVE-2026-74846
The legacy password verifier in Catalyst::Plugin::Authentication compares passwords and hashes with eq, so response time reveals how many leading bytes match. A remote attacker can use those timing differences to guess a stored password or hash.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 08:19 UTC. All times on this page are UTC.
Applications that use Catalyst::Plugin::Authentication and still call the deprecated legacy login method are exposed, because that path uses the eq-based comparison. Apps that use the realm-based verifier fixed in CVE-2026-5091 are not described as affected by this flaw. unknown whether other configurations are affected.
No product ranges from the sources yet.
perl -MCatalyst::Plugin::Authentication -e 'print $Catalyst::Plugin::Authentication::VERSION'login method in the application0.10029 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier.
CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match.
A remote attacker can use response-time differences to guess the stored password or hash.
This page as .md · .json · in your agent: get_signal("CVE-2026-74846")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.