CVE-2026-119037
Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty. signature_valid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty key. A secret read from an unset environment variable, or an empty entry in a list of rotated secrets, is used as is. A remote attacker can sign a forged webhook with an empty key and have it accepted as sent by GoCardless.
| CWE | CWE-347 |
| Published | Oct 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for
Be the first to know when new unknown vulnerabilities are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup