Zero Radar
← feed
HighVulnerabilityCVE-2026-119038updated 30 Oct 2026, 17:22 UTC

Business::GoCardless Perl module lets leaked payment redirect IDs charge another customer

A Perl library for taking GoCardless direct debit payments can be tricked into charging someone else's bank mandate. An attacker who learns a payment redirect ID can use it to create payments.

Fixed in Version 1.01 or later. · out Official, 2 sources
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?YesVersion 1.01 or later. · since 30 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker gets flow IDRedirect flow ID leaked from another customer
  2. 2Module confirms flowNo session token check before completing
  3. 3Payment createdCharged against the victim's mandate
  4. 4Repeat calls workFlows with a mandate are returned as confirmed
  5. ResultUnauthorized payments charged to victim's mandate

What happened

Business::GoCardless versions before 1.01 for Perl complete GoCardless redirect flows without verifying the session token, so a leaked redirect flow ID is accepted and used to create payments or subscriptions against the flow's mandate. Since version 1.00, flows that already have a mandate are returned as confirmed without re-validation, so repeated calls create new payments.

Why it is dangerous: An attacker who obtains another customer's redirect flow ID can create payments or subscriptions charged against that customer's mandate, causing unauthorized charges. Businesses and sites using this module to take GoCardless payments are at risk.

Are you affected?

You are affected if you use Business::GoCardless for Perl at a version before 1.01 to handle GoCardless redirect flows.

Business::GoCardless (Perl) versions before 1.01; the repeated-payment behavior specifically affects versions 1.00 and later.

What to do

  1. Update Business::GoCardless to version 1.01 or later
  2. Review recent GoCardless payments and subscriptions for charges you did not authorize
  3. Treat redirect flow IDs as sensitive and avoid exposing them in logs, URLs, or client-side code

Timeline

  1. 30 Oct 2026, 13:18 UTC
    Publicly disclosed
  2. 30 Oct 2026, 15:47 UTC
    Reported by oss-security · oss-security
  3. 30 Oct 2026, 16:00 UTC
    Picked up by Zero Radar
  4. 30 Oct 2026, 17:22 UTC
    NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Security researchers research teams and mailing lists

Technical details

ID
CVE-2026-119038
Disclosed
30 Oct 2026, 13:18 UTC
On Zero Radar
30 Oct 2026, 16:00 UTC (3 h after disclosure)
Last change
30 Oct 2026, 17:22 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Business::GoCardless Perl module lets leaked payment redirect IDs charge another customer · Zero Radar