Session Token Vulnerability in Business::GoCardless for Perl
CVE-2026-119038
What is CVE-2026-119038?
The Business::GoCardless for Perl library prior to version 1.01 has a critical flaw in its session token handling that permits remote attackers to manipulate payment flows. The absence of proper session token verification allows unauthorized users to utilize leaked redirect flow IDs, enabling them to initiate payments against another customer's mandate without their consent. This vulnerability arises from the confirm_resource method, which fails to require a session token from the caller and instead relies on tokens retrieved from the GoCardless API, thus bypassing essential security checks. As a result, an attacker can exploit this weakness to fraudulently create payments or subscriptions, posing severe security risks to users of older versions.