Catalyst::Plugin::Authentication before 0.10029 allows timing attacks on passwords (CVE-2026-74846)
Original title: CVE-2026-74846: Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier
Legacy password verifier uses eq comparisons enabling timing attacks; fixed in version 0.10029.
A vulnerability in Catalyst::Plugin::Authentication for Perl versions before 0.10029 allows timing attacks on stored passwords via eq comparisons in the legacy password verifier. Posted by Robert Rothenberg on Nov 03.
- Affected versions before 0.10029
- Attack via eq comparisons in legacy verifier
- Language Perl
- Timing attack on stored passwords
Impact: timing attacks on stored passwords
- CVEs
- CVE-2026-74846
- Products
- Catalyst::Plugin::Authentication
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-74846 | Timing attack on stored passwords in Catalyst::Plugin::Authentication before 0.10029 | — | — |
From the original article
Posted by Robert Rothenberg on Nov 03 ======================================================================== https://metacpan. org/dist/Catalyst-Plugin-Authentication ...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.