Zero Radar
← feed
HighVulnerabilityCVE-2026-119037updated 30 Oct 2026, 17:22 UTC

Perl GoCardless library accepts forged payment webhooks with empty secret

If the app's webhook secret is blank, anyone on the internet can send fake payment notices that the app will believe came from GoCardless. This can make the app record payments or changes that never happened.

Fixed in Version 1.01 or later · out Official, 2 sources
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?YesVersion 1.01 or later · since 30 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker crafts webhookSigns payload with empty key
  2. 2Sends to webhook endpointRequest looks like GoCardless
  3. 3Library checks signatureEmpty secret is accepted
  4. 4Forged event processedApp trusts fake payment data
  5. ResultFake payment events are accepted as genuine

What happened

Business::GoCardless for Perl, before version 1.01, does not reject a webhook secret that is undef or an empty string. Digest::SHA then uses an empty HMAC key, so signature_valid accepts a signature an attacker can compute themselves.

Why it is dangerous: Attackers can forge webhook events and have them accepted as genuine GoCardless messages, which can lead to fake payment or mandate status changes in the affected application.

Are you affected?

You are affected if you run Business::GoCardless before 1.01 and your webhook secret can be unset or empty, for example when it is read from an unset environment variable or an empty entry in a rotated secrets list.

Business::GoCardless for Perl, all versions before 1.01

What to do

  1. Upgrade Business::GoCardless to version 1.01 or later
  2. Confirm your webhook secret is set to a non-empty value in production
  3. Check that no empty entries remain in any list of rotated webhook secrets

Timeline

  1. 30 Oct 2026, 13:18 UTC
    Publicly disclosed
  2. 30 Oct 2026, 15:47 UTC
    Reported by oss-security · oss-security
  3. 30 Oct 2026, 16:00 UTC
    Picked up by Zero Radar
  4. 30 Oct 2026, 17:22 UTC
    NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Security researchers research teams and mailing lists

Technical details

ID
CVE-2026-119037
Disclosed
30 Oct 2026, 13:18 UTC
On Zero Radar
30 Oct 2026, 16:00 UTC (3 h after disclosure)
Last change
30 Oct 2026, 17:22 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Perl GoCardless library accepts forged payment webhooks with empty secret · Zero Radar