Webhook Forgery Vulnerability in Business::GoCardless by Perl
CVE-2026-119037

Currently unrated

Key Information:

Status
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119037?

The Business::GoCardless library before version 1.01 for Perl is susceptible to a critical flaw allowing remote attackers to send forged webhooks. If a configured webhook secret is undefined or empty, the library's signature validation process fails to reject it. This allows attackers to exploit the lack of proper HMAC key checks, potentially leading to unauthorized actions by masquerading as legitimate webhook senders. This vulnerability emphasizes the importance of ensuring that all webhook secrets are correctly defined and managed to prevent unauthorized access.

References

https://metacpan.org/release/LEEJO/Business-GoCardless-1....
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.