https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 31 Oct 2026 22:29:57 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-119037 <p>Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty.</p> <p>signature_valid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty key. A secret read from an unset environment variable, or an empty entry in a list of rotated secrets, is used as is.</p> <p>A remote attacker can sign a forged webhook with an empty key and have it accepted as sent by GoCardless.</p> <p>Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty.</p> <p>signature_valid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty key. A secret read from an unset environment variable, or an empty entry in a list of rotated secrets, is used as is.</p> <p>A remote attacker can sign a forged webhook with an empty key and have it accepted as sent by GoCardless.</p> https://db.gcve.eu/vuln/fkie_cve-2026-119037 https://db.gcve.eu/vuln/ghsa-25v3-44x4-vgq4 <p>Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty.</p> <p>signature_valid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty key. A secret read from an unset environment variable, or an empty entry in a list of rotated secrets, is used as is.</p> <p>A remote attacker can sign a forged webhook with an empty key and have it accepted as sent by GoCardless.</p> <p>Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty.</p> <p>signature_valid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty key. A secret read from an unset environment variable, or an empty entry in a list of rotated secrets, is used as is.</p> <p>A remote attacker can sign a forged webhook with an empty key and have it accepted as sent by GoCardless.</p> https://db.gcve.eu/vuln/ghsa-25v3-44x4-vgq4