Timing Attack Vulnerability in Catalyst::Plugin::Authentication for Perl
CVE-2026-74846

Currently unrated

Key Information:

Status
Vendor
CVE Published:
3 November 2026

What is CVE-2026-74846?

A vulnerability in Catalyst::Plugin::Authentication for Perl versions prior to 0.10029 allows attackers to execute timing attacks on stored passwords through insecure eq comparisons in the legacy password verifier. By exploiting the differing response times based on how many leading bytes of the password match, an attacker may deduce the correct password or hash through systematic guessing. The issue arises specifically from the deprecated login method which utilizes an outdated verifier, making it susceptible to these vulnerabilities.

References

https://metacpan.org/release/ETHER/Catalyst-Plugin-Authen...
release-notes
https://github.com/perl-catalyst/Catalyst-Plugin-Authenti...
patch
https://www.cve.org/CVERecord?id=CVE-2026-5091

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.