https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-31T22:29:56.517774+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-119037 fkie_cve-2026-119037 2026-10-31T22:29:56.547415+00:00

Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty.

signature_valid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty key. A secret read from an unset environment variable, or an empty entry in a list of rotated secrets, is used as is.

A remote attacker can sign a forged webhook with an empty key and have it accepted as sent by GoCardless.

 https://db.gcve.eu/vuln/ghsa-25v3-44x4-vgq4 GHSA-25v3-44x4-vgq4 2026-10-31T22:29:56.547510+00:00

Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty.

signature_valid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty key. A secret read from an unset environment variable, or an empty entry in a list of rotated secrets, is used as is.

A remote attacker can sign a forged webhook with an empty key and have it accepted as sent by GoCardless.