CVE-2026-119037

Name of the Vulnerable Software and Affected Versions Business::GoCardless versions prior to 1.01

Description Business::GoCardless for Perl accepts forged webhooks when a configured webhook secret is undefined or empty. The signature valid() function uses each configured secret as the HMAC key; however, it does not reject undefined or empty strings, which are treated as empty keys by Digest::SHA. This occurs when a secret is read from an unset environment variable or exists as an empty entry in a list of rotated secrets. A remote attacker can sign a forged webhook using an empty key to have it accepted as a legitimate communication from GoCardless.

Recommendations Update Business::GoCardless to version 1.01 or later.