CVE-2026-119037: Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty

Published Oct 30, 2026

Updated

Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty.

signaturevalid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty key. A secret read from an unset environment variable, or an empty entry in a list of rotated secrets, is used as is.

A remote attacker can sign a forged webhook with an empty key and have it accepted as sent by GoCardless.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Business::GoCardless to a version that resolves this vulnerability.
Fixed in 1.01

Event History

Oct 30, 2026

CVE Published

via MITRE·12:56 PM

Data Sourced

via MITRE·12:56 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·01:18 PM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to forged webhooks?

Deployments using a version before 1.01 are exposed if any configured webhook secret is undef or an empty string. This can occur when a secret is read from an unset environment variable or when an empty value appears in a rotated-secret list.

What does an attacker need to exploit this?

A remote attacker needs to send a forged webhook signed with an empty HMAC key. The vulnerable signature validation accepts that signature when it evaluates an undef or empty configured secret as an empty key.

Are deployments with properly populated webhook secrets affected?

The described condition requires an undef or empty configured secret. The provided information does not indicate that a non-empty configured secret is treated as an empty key.

What should be checked while upgrading is pending?

Check every configured webhook secret, including values loaded from environment variables and all entries used for secret rotation. Ensure no value is unset, undef, or an empty string.

CVE-2026-119037: Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty

Remediation

Event History

Frequently Asked Questions

Who is exposed to forged webhooks?

What does an attacker need to exploit this?

Are deployments with properly populated webhook secrets affected?

What should be checked while upgrading is pending?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to forged webhooks?

What does an attacker need to exploit this?

Are deployments with properly populated webhook secrets affected?

What should be checked while upgrading is pending?