CVE-2026-74846High· 7.5▾ TwilightCatalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier. CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, use…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the CISA ADP record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
Last analysed / modified upstream
— → 7.5
none → high
0.3% → 0.4%
Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier.
CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match.
A remote attacker can use response-time differences to guess the stored password or hash.
Catalyst-Plugin-Authentication < 0.10029Upgrade to Catalyst-Plugin-Authentication 0.10029 or later.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-15041Low· 3.7389-ds-base: 389-ds-base: non-constant-time comparison in pbkdf2-sha256 password verification
CVE-2026-103021Medium· 5.3OpenEMR: Username Enumeration via Pre-Authentication User Settings Loading
CVE-2026-85286Low· 3.7HomeBox: Timing Side-Channel in Login Endpoint Allows User Enumeration via Bcrypt Hashing Delay
CVE-2024-3296Medium· 5.9Rust-openssl: timing based side-channel can lead to a bleichenbacher style attack
CVE-2024-2467Medium· 5.9Perl-crypt-openssl-rsa: side-channel attack in pkcs#1 v1.5 padding mode (marvin attack)
CVE-2026-63410Medium· 5.9secp256k1-native: Compiler-reconstructed secret-dependent branch in native scalar multiplication