---
id: CVE-2026-119037
title: >-
  Business::GoCardless versions before 1.01 for Perl accept forged webhooks when
  a configured webhook secret is undef or empty
summary: >-
  Business::GoCardless versions before 1.01 for Perl accept forged webhooks when
  a configured webhook secret is undef or empty.


  signature_valid uses each configured secret as the HMAC key, and nothing
  rejects undef or an empty string, bot…
severity: none
cwe:
  - CWE-347
product: Business-GoCardless
affected:
  - Business-GoCardless < 1.01
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:56:27.922Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119037'
references:
  - url: 'https://metacpan.org/release/LEEJO/Business-GoCardless-1.01/changes'
tags:
  - cve.org
epss: 0.00123
epssPercentile: 0.02077
ingestedAt: '2026-11-05T16:07:30.224Z'
---

## Overview

Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty.

signature_valid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty key. A secret read from an unset environment variable, or an empty entry in a list of rotated secrets, is used as is.

A remote attacker can sign a forged webhook with an empty key and have it accepted as sent by GoCardless.

## Affected

- `Business-GoCardless < 1.01`

## Remediation

Upgrade to Business-GoCardless 1.01 or later.