{"id":"CVE-2026-74846","aliases":[],"cve":{"records":[{"id":"CVE-2026-74846","source":"CPANSec","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-08-17T06:30:29.057Z","published":"2026-11-03T07:51:25.290Z","modified":"2026-11-06T18:42:56.084Z"}],"publishers":[{"name":"CPANSec","role":"CNA","organizationId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","modified":"2026-11-03T07:51:25.290Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-06T18:42:56.084Z"}],"references":[{"url":"https://metacpan.org/release/ETHER/Catalyst-Plugin-Authentication-0.10029/changes","tags":["release-notes"],"source":"CPANSec"},{"url":"https://github.com/perl-catalyst/Catalyst-Plugin-Authentication/commit/ba4435f1fa6b641e6c8793c88b5433afa83ceafa.patch","tags":["patch"],"source":"CPANSec"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5091","tags":[],"source":"CPANSec"}],"weaknesses":[{"id":"CWE-208","description":"CWE-208 Observable Timing Discrepancy","source":"CPANSec"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-06T18:42:32.907151Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier","titleSource":"CPANSec","descriptionSource":"CPANSec","description":"Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier.\n\nCVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match.\n\nA remote attacker can use response-time differences to guess the stored password or hash.","score":7.5,"severity":"high","published":"2026-11-03T07:51:25.290Z","modified":"2026-11-06T18:42:56.084Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"","name":"Catalyst-Plugin-Authentication","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"0.10029","versionType":"custom"}],"defaultStatus":"unaffected","packageURL":"pkg:cpan/Catalyst-Plugin-Authentication","cpes":[],"source":"CPANSec","url":"https://www.cve.org/CVERecord?id=CVE-2026-74846"}],"remediation":[{"text":"Upgrade to Catalyst-Plugin-Authentication 0.10029 or later.","source":"CPANSec","url":"https://www.cve.org/CVERecord?id=CVE-2026-74846"}],"references":["https://metacpan.org/release/ETHER/Catalyst-Plugin-Authentication-0.10029/changes","https://github.com/perl-catalyst/Catalyst-Plugin-Authentication/commit/ba4435f1fa6b641e6c8793c88b5433afa83ceafa.patch","https://www.cve.org/CVERecord?id=CVE-2026-5091"],"sources":[{"name":"CVE","id":"CVE-2026-74846","modified":"2026-11-06T18:42:56.084Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-74846"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5}],"sourceAffected":[],"observedAt":"2026-11-06T19:34:03.940Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:30:32.029Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-03T08:05:34.073Z","attemptedAt":"2026-11-03T08:05:34.073Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-03T08:05:34.073Z","attemptedAt":"2026-11-03T08:05:34.073Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-03T08:05:34.073Z","attemptedAt":"2026-11-03T08:05:34.073Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-03T08:05:32.885Z","attemptedAt":"2026-11-03T08:05:32.885Z"}],"evidence":[],"aiSummary":{"text":"Catalyst::Plugin::Authentication versions before 0.10029 for Perl are vulnerable to timing attacks on stored passwords via eq comparisons in the legacy password verifier, potentially allowing a remote attacker to guess the stored password or hash. The vulnerability is due to the comparison time depending on matching leading bytes.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-03T08:01:09.451Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-74846"}]}}