CVE-2026-119037
Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty
- State
- Published
- Severity
- Not scored
- Published
- Oct 30, 2026
- Updated
- Oct 30, 2026
- Reserved
- Oct 29, 2026
Description
Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty.
signature_valid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty key. A secret read from an unset environment variable, or an empty entry in a list of rotated secrets, is used as is.
A remote attacker can sign a forged webhook with an empty key and have it accepted as sent by GoCardless.
Scores
The record has no CVSS score.
Weaknesses
- CWE-347 Improper Verification of Cryptographic Signature
Affected Products
| Product | Versions |
|---|---|
Business-GoCardless |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.