Vulnerability Description
Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty. signature_valid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty key. A secret read from an unset environment variable, or an empty entry in a list of rotated secrets, is used as is. A remote attacker can sign a forged webhook with an empty key and have it accepted as sent by GoCardless.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-119037?
CVE-2026-119037 is a documented vulnerability. Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty. signature_valid uses each configured secret as the HMAC key, and nothing ...
How severe is CVE-2026-119037?
CVSS scoring is not yet available for CVE-2026-119037. Check NVD for updates.
Is there a patch for CVE-2026-119037?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.