Catalyst::Plugin::Authentication before 0.10029 allows timing attacks on passwords (CVE-2026-74846)
Legacy password verifier uses eq comparisons enabling timing attacks; fixed in version 0.10029.
30
CVE-2026-74846
Timing attack on stored passwords in Catalyst::Plugin::Authentication before 0.10029
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier. The legacy verifier compares clear-text passwords, crypt hashes and base64 digests with eq, so comparison time depends on matching leading bytes. A remote attacker can use response-time differences to guess the stored password or hash. Affects users of the deprecated login method.
What to do: Upgrade to Catalyst::Plugin::Authentication 0.10029 or later. No workaround provided.
| Product | Affected | Fixed in |
|---|---|---|
| Catalyst Plugin::Authentication | before 0.10029 | 0.10029 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier. CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match. A remote attacker can use response-time differences to guess the stored password or hash.
- Weakness
- CWE-208