{"id":"CVE-2026-119037","published":"2026-10-30T13:18:32.670","lastModified":"2026-10-30T17:13:54.187","description":"Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty.\n\nsignature_valid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty key. A secret read from an unset environment variable, or an empty entry in a list of rotated secrets, is used as is.\n\nA remote attacker can sign a forged webhook with an empty key and have it accepted as sent by GoCardless.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-347"],"vendors":[],"products":[],"references":[{"url":"https://metacpan.org/release/LEEJO/Business-GoCardless-1.01/changes","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}