CVE-2026-74846
UnknownSummary
Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match.
Risk Assessment
A remote attacker can use response-time differences to guess the stored password or hash, potentially leading to account compromise.
Recommendation
Update Catalyst::Plugin::Authentication to version 0.10029 or later. Migrate applications from the deprecated login method to the realm-based verifier.
Other vulnerabilities in Catalyst::Plugin::Authentication
See all- CVE-2009-10007Critical
A vulnerability in the Catalyst::Plugin::Authentication library for Perl before version 0.10_027 allows session fixation attacks. The library does not automatically change the session ID after authentication, enabling an attacker to hijack the victim's session.
- CVE-2026-5091Medium
Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks. These versions use Perl's built-in eq comparison. Discrepencies in timing could be used to guess the underlying hash or password.
Original NVD description (English source)
Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier. CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match. A remote attacker can use response-time differences to guess the stored password or hash.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS