CVE-2026-119037
Received Received - Intake

Forgeable Webhook Signatures in GoCardless Perl Library

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: CPANSec

Description
Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty. signature_valid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty key. A secret read from an unset environment variable, or an empty entry in a list of rotated secrets, is used as is. A remote attacker can sign a forged webhook with an empty key and have it accepted as sent by GoCardless.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119037
EUVD
EUVD-2026-113911

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gocardless business_gocardless to 1.01 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Business::GoCardless versions before 1.01 for Perl. It allows forged webhooks to be accepted if the configured webhook secret is undefined or empty. The issue occurs because Digest::SHA treats undef or empty strings as an empty key, so no validation rejects these cases.

Detection Guidance

Check if the GoCardless Perl library version is before 1.01 by inspecting installed modules or dependency files. Review webhook configurations for unset or empty secrets in environment variables or configuration files.

Impact Analysis

A remote attacker could exploit this to sign fake webhooks using an empty key, tricking the system into accepting them as legitimate from GoCardless. This could lead to unauthorized transactions or data manipulation if webhooks trigger actions like payments or account updates.

Mitigation Strategies

Upgrade the GoCardless Perl library to version 1.01 or later. Ensure all webhook secrets are set and non-empty in configuration files and environment variables. Rotate any exposed secrets and validate webhook signatures strictly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119037. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart