Business::GoCardless before 1.01 has three Perl webhook flaws
Empty webhook secrets accept forgeries, and unsigned legacy payloads can exhaust memory before verification.
42
Vulnerability1 · 1 read
CVE-2026-119037
Forged webhook acceptance in Business::GoCardless before 1.01
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Business::GoCardless for Perl before 1.01 accepts forged GoCardless webhooks when a configured webhook secret is undef or empty. signature_valid uses each secret as the HMAC key, and Digest::SHA treats an unset or empty value as an empty key. A remote attacker can sign a webhook with an empty key and have it treated as sent by GoCardless. Only installs that load an unset environment variable or an empty rotated-secret entry are affected.
What to do: Upgrade Business::GoCardless to 1.01. Do not leave the webhook secret unset or include an empty entry among rotated secrets.
| Product | Affected | Fixed in |
|---|---|---|
| Business::GoCardless | before 1.01 | 1.01 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty. signature_valid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty key. A secret read from an unset environment variable, or an empty entry in a list of rotated secrets, is used as is. A remote attacker can sign a forged webhook with an empty key and have it accepted as sent by GoCardless.
- Weakness
- CWE-347