CVE-2026-74846
Received Received - Intake

Timing Attack in Catalyst::Plugin::Authentication

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: CPANSec

Description
Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier. CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match. A remote attacker can use response-time differences to guess the stored password or hash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-74846
EUVD
EUVD-2026-115722

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
perl catalyst_plugin_authentication to 0.10029 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-208 Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Catalyst::Plugin::Authentication versions before 0.10029 for Perl. It allows timing attacks on stored passwords due to insecure string comparisons using the eq operator in the legacy password verifier. The comparison time depends on how many leading bytes match, enabling attackers to guess passwords or hashes by measuring response times.

Impact Analysis

A remote attacker could exploit this to guess stored passwords or hashes by analyzing response-time differences during authentication attempts. This could lead to unauthorized access to user accounts or sensitive data if weak passwords are used.

Compliance Impact

This vulnerability could violate data protection requirements under GDPR and HIPAA by allowing unauthorized access to personal or health information. Organizations using affected versions may fail to implement adequate security measures for password storage and authentication.

Mitigation Strategies

Update Catalyst::Plugin::Authentication to version 0.10029 or later to replace insecure eq comparisons with secure comparison functions in password verification.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74846. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...