{"id":"CVE-2026-74846","title":"Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier","summary":"Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier.\n\nCVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, use…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"adp","cwe":["CWE-208"],"product":"Catalyst-Plugin-Authentication","affected":["Catalyst-Plugin-Authentication < 0.10029"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-11-06T18:42:32.907151Z"},"published":"2026-11-03","updated":"2026-11-06","sourceUpdated":"2026-11-06T18:42:56.084Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74846","references":[{"url":"https://metacpan.org/release/ETHER/Catalyst-Plugin-Authentication-0.10029/changes"},{"url":"https://github.com/perl-catalyst/Catalyst-Plugin-Authentication/commit/ba4435f1fa6b641e6c8793c88b5433afa83ceafa.patch"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5091"}],"tags":["cve.org"],"epss":0.00405,"epssPercentile":0.35028,"ingestedAt":"2026-11-05T19:30:42.931Z","slug":"CVE-2026-74846","body":"## Overview\n\nCatalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier.\n\nCVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match.\n\nA remote attacker can use response-time differences to guess the stored password or hash.\n\n## Affected\n\n- `Catalyst-Plugin-Authentication < 0.10029`\n\n## Remediation\n\nUpgrade to Catalyst-Plugin-Authentication 0.10029 or later.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":235550,"id":"CVE-2026-74846","ts":1793991733029,"field":"cvss","old":null,"new":"7.5"},{"seq":235549,"id":"CVE-2026-74846","ts":1793991733029,"field":"severity","old":"none","new":"high"}]}