{"id":"CVE-2026-119037","aliases":[],"cve":{"records":[{"id":"CVE-2026-119037","source":"CPANSec","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-29T11:38:31.744Z","published":"2026-10-30T12:56:27.922Z","modified":"2026-10-30T12:56:27.922Z"}],"publishers":[{"name":"CPANSec","role":"CNA","organizationId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","modified":"2026-10-30T12:56:27.922Z"}],"references":[{"url":"https://metacpan.org/release/LEEJO/Business-GoCardless-1.01/changes","tags":["release-notes"],"source":"CPANSec"}],"weaknesses":[{"id":"CWE-347","description":"CWE-347 Improper Verification of Cryptographic Signature","source":"CPANSec"}],"applicability":[],"prioritization":[]},"title":"Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty","titleSource":"CPANSec","descriptionSource":"CPANSec","description":"Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty.\n\nsignature_valid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty key. A secret read from an unset environment variable, or an empty entry in a list of rotated secrets, is used as is.\n\nA remote attacker can sign a forged webhook with an empty key and have it accepted as sent by GoCardless.","score":null,"severity":"unknown","published":"2026-10-30T12:56:27.922Z","modified":"2026-10-30T12:56:27.922Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"","name":"Business-GoCardless","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"1.01","versionType":"custom"}],"defaultStatus":"unaffected","packageURL":"pkg:cpan/Business-GoCardless","cpes":[],"source":"CPANSec","url":"https://www.cve.org/CVERecord?id=CVE-2026-119037"}],"remediation":[{"text":"Upgrade to Business-GoCardless 1.01 or later.","source":"CPANSec","url":"https://www.cve.org/CVERecord?id=CVE-2026-119037"}],"references":["https://metacpan.org/release/LEEJO/Business-GoCardless-1.01/changes"],"sources":[{"name":"CVE","id":"CVE-2026-119037","modified":"2026-10-30T12:56:27.922Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-119037"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-10-30T13:08:30.133Z","kev":{"status":"not-listed","checkedAt":"2026-10-30T22:50:31.153Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-10-30T13:10:33.023Z","attemptedAt":"2026-10-30T13:10:33.023Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T13:10:33.226Z","attemptedAt":"2026-10-30T13:10:33.226Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T13:10:33.069Z","attemptedAt":"2026-10-30T13:10:33.069Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T13:10:33.083Z","attemptedAt":"2026-10-30T13:10:33.083Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-113911","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113911","modified":"Oct 30, 2026, 12:56:27 PM","checkedAt":"2026-10-30T13:10:33.069Z"}],"aiSummary":{"text":"Business::GoCardless for Perl versions before 1.01 accept forged webhooks when a configured webhook secret is empty or undefined, allowing a remote attacker to sign a forged webhook with an empty key. The weakness is due to improper verification of cryptographic signatures. This affects versions less than 1.01.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T13:11:03.686Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-119037"}]}}