Direct naar de inhoud
⚡ Kritieke cyberalerts voor jouw sector & systemen — direct in je inbox. Aanmelden →
cybernieuws.nl Cybersecurity en informatiebeveiling nieuws alerts live · 9 min 163 bronnen 1 kritiek 2 vandaag
CVE's Videos Dagbriefing

← Terug naar CVE-database

CVE-2026-119037

HIGH · 7.5 CVSS Gepubliceerd: CWE-347

Beschrijving NL

Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty. signature_valid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty key. A secret read from an unset environment variable, or an empty entry in a list of rotated secrets, is used as is. A remote attacker can sign a forged webhook with an empty key and have it accepted as sent by GoCardless.

Origineel (Engels) tonen

Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty.

signature_valid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty key. A secret read from an unset environment variable, or an empty entry in a list of rotated secrets, is used as is.

A remote attacker can sign a forged webhook with an empty key and have it accepted as sent by GoCardless.

References