CVE-2026-74846

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74846", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-08-17T06:30:29.057Z", "datePublished": "2026-11-03T07:51:25.290Z", "dateUpdated": "2026-11-06T18:42:56.084Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["Catalyst::Plugin::Authentication"], "packageName": "Catalyst-Plugin-Authentication", "packageURL": "pkg:cpan/Catalyst-Plugin-Authentication", "programFiles": ["lib/Catalyst/Plugin/Authentication/Credential/Password.pm"], "programRoutines": [{"name": "Catalyst::Plugin::Authentication::Credential::Password::_check_password"}], "repo": "https://github.com/perl-catalyst/Catalyst-Plugin-Authentication", "versions": [{"lessThan": "0.10029", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier.\n\nCVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match.\n\nA remote attacker can use response-time differences to guess the stored password or hash."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-208", "description": "CWE-208 Observable Timing Discrepancy", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-11-03T07:51:25.290Z"}, "references": [{"tags": ["release-notes"], "url": "https://metacpan.org/release/ETHER/Catalyst-Plugin-Authentication-0.10029/changes"}, {"tags": ["patch"], "url": "https://github.com/perl-catalyst/Catalyst-Plugin-Authentication/commit/ba4435f1fa6b641e6c8793c88b5433afa83ceafa.patch"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-5091"}], "solutions": [{"lang": "en", "value": "Upgrade to Catalyst-Plugin-Authentication 0.10029 or later."}], "source": {"discovery": "UNKNOWN"}, "title": "Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-06T18:42:32.907151Z", "id": "CVE-2026-74846", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T18:42:56.084Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-74846", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T18:42:32.907151Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T18:42:52.100Z"}}], "cna": {"title": "Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/perl-catalyst/Catalyst-Plugin-Authentication", "modules": ["Catalyst::Plugin::Authentication"], "versions": [{"status": "affected", "version": "0", "lessThan": "0.10029", "versionType": "custom"}], "packageURL": "pkg:cpan/Catalyst-Plugin-Authentication", "packageName": "Catalyst-Plugin-Authentication", "programFiles": ["lib/Catalyst/Plugin/Authentication/Credential/Password.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Catalyst::Plugin::Authentication::Credential::Password::_check_password"}]}], "solutions": [{"lang": "en", "value": "Upgrade to Catalyst-Plugin-Authentication 0.10029 or later."}], "references": [{"url": "https://metacpan.org/release/ETHER/Catalyst-Plugin-Authentication-0.10029/changes", "tags": ["release-notes"]}, {"url": "https://github.com/perl-catalyst/Catalyst-Plugin-Authentication/commit/ba4435f1fa6b641e6c8793c88b5433afa83ceafa.patch", "tags": ["patch"]}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-5091"}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier.\n\nCVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match.\n\nA remote attacker can use response-time differences to guess the stored password or hash."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-208", "description": "CWE-208 Observable Timing Discrepancy"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-11-03T07:51:25.290Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74846", "state": "PUBLISHED", "dateUpdated": "2026-11-06T18:42:56.084Z", "dateReserved": "2026-08-17T06:30:29.057Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-11-03T07:51:25.290Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["Catalyst::Plugin::Authentication"], "packageName": "Catalyst-Plugin-Authentication", "packageURL": "pkg:cpan/Catalyst-Plugin-Authentication", "programFiles": ["lib/Catalyst/Plugin/Authentication/Credential/Password.pm"], "programRoutines": [{"name": "Catalyst::Plugin::Authentication::Credential::Password::_check_password"}], "repo": "https://github.com/perl-catalyst/Catalyst-Plugin-Authentication", "versions": [{"lessThan": "0.10029", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier.\n\nCVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match.\n\nA remote attacker can use response-time differences to guess the stored password or hash."}], "id": "CVE-2026-74846", "lastModified": "2026-11-06T19:17:56.923", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74846", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T18:42:32.907151Z", "version": "2.0.3"}}]}, "published": "2026-11-03T08:17:15.673", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/perl-catalyst/Catalyst-Plugin-Authentication/commit/ba4435f1fa6b641e6c8793c88b5433afa83ceafa.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/ETHER/Catalyst-Plugin-Authentication-0.10029/changes"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://www.cve.org/CVERecord?id=CVE-2026-5091"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-208"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{"bugzilla": {"description": "perl-catalyst-plugin-authentication: Catalyst::Plugin::Authentication: Information disclosure via timing attack in password verification", "id": "2565629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565629"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-208", "details": ["Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier.\nCVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match.\nA remote attacker can use response-time differences to guess the stored password or hash.", "A flaw was found in Catalyst::Plugin::Authentication. The legacy password verification mechanism performs non-constant-time string comparisons when checking passwords and cryptographic hashes. A remote attacker can exploit this timing discrepancy by measuring response-time differences to incrementally deduce stored credentials, leading to information disclosure."], "name": "CVE-2026-74846", "public_date": "2026-11-03T07:51:25Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74846\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74846\nhttps://github.com/perl-catalyst/Catalyst-Plugin-Authentication/commit/ba4435f1fa6b641e6c8793c88b5433afa83ceafa.patch\nhttps://metacpan.org/release/ETHER/Catalyst-Plugin-Authentication-0.10029/changes\nhttps://www.cve.org/CVERecord?id=CVE-2026-5091"], "statement": "This vulnerability is rated with Moderate impact because exploiting the timing discrepancy remotely requires high attack complexity, including minimal network latency variance and extensive statistical sampling. Furthermore, the issue is confined to applications utilizing deprecated legacy authentication routines rather than standard realm-based verifiers. Supported Red Hat Enterprise Linux releases do not ship this package, significantly reducing exposure across default enterprise environments.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.10029)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "catalyst::plugin::authentication", "vendor": "perl"}], "created": "2026-11-03T10:00:15.543473+00:00", "updated": "2026-11-06T20:45:07.550962+00:00", "vendors": ["perl", "perl$PRODUCT$catalyst::plugin::authentication"]}