{"affected":[{"defaultStatus":"unaffected","ecosystem":"cpan","packageName":"Business-GoCardless","product":"","source":"CNA: CPANSec","vendor":"","versions":[{"lessThan":"1.01","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-119037","cwes":["CWE-347"],"description":"Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty.\n\nsignature_valid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty key. A secret read from an unset environment variable, or an empty entry in a list of rotated secrets, is used as is.\n\nA remote attacker can sign a forged webhook with an empty key and have it accepted as sent by GoCardless.","epss":{"date":"2026-11-06","percentile":0.02081,"score":0.00123},"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1793980395012,"publishedAt":1793364987922,"references":[{"source":"CNA: CPANSec","tags":["release-notes"],"url":"https://metacpan.org/release/LEEJO/Business-GoCardless-1.01/changes"}],"remediation":[{"kind":"fix","source":"CNA: CPANSec","text":"Upgrade to Business-GoCardless 1.01 or later."}],"revision":"8027d20c8c35a194407628e4ab9b4f7191b0fd0a98fedf34cb41df3895e14f92","sources":[{"modifiedAt":1793980395012,"name":"CNA: CPANSec","retrievedAt":1793981388006,"url":"https://www.cve.org/CVERecord?id=CVE-2026-119037"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793981414520,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-119037"}],"ssvc":{"assessedAt":1793980390969,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty","updatedAt":1793981414520}