Executive brief
Catalyst::Plugin::Authentication is a software component used by Perl-based web applications to handle user logins. A security flaw in how it verifies passwords allows an attacker to potentially guess valid credentials by measuring tiny differences in how long the server takes to respond. If successful, an attacker could gain unauthorized access to user accounts or administrative panels.
Technical details
The vulnerability is a timing side-channel (CWE-208) located in the password verification logic of Catalyst::Plugin::Authentication. The component uses Perl's built-in 'eq' operator for string comparison, which returns as soon as a mismatch is found. By measuring the time taken for the server to respond to various login attempts, a remote attacker can infer the contents of the stored password hash or the password itself. The fix involves implementing a constant-time comparison algorithm (_secure_compare) to ensure that the comparison time does not leak information about the string's content or length. The issue is addressed in version 0.10_025.
Affected products
- Perl Catalyst Project Catalyst::Plugin::Authentication through 0.10024
Timeline
- 2026-05-16: patched: Fix committed to repository
- 2026-05-21: disclosed: CVE published to NVD