Every CVE Search/ Get API key

CVE-2026-74846

Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier

7.5 HighFix available

Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier.

CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match.

A remote attacker can use response-time differences to guess the stored password or hash.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.40%Up 0.1 points since Nov 3, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier

Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier.

CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match.

A remote attacker can use response-time differences to guess the stored password or hash.

Record
CVE-2026-74846
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-208
Updated
2026-11-06
EUVDEUVD-2026-115722 7.5

Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier.

CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match.

A remote attacker can use response-time differences to guess the stored password or hash.

Record
EUVD-2026-115722
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-06
GitHub AdvisoriesGHSA-p4f5-m8h6-x7p5 7.5

Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored...

Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier.

CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match.

A remote attacker can use response-time differences to guess the stored password or hash.

Record
GHSA-p4f5-m8h6-x7p5
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-208
Updated
2026-11-06
NVD 7.5

Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier.

CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match.

A remote attacker can use response-time differences to guess the stored password or hash.

Record
CVE-2026-74846
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-208
Updated
2026-11-06
OSV 7.5

Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier

Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier.

CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match.

A remote attacker can use response-time differences to guess the stored password or hash.

Record
CVE-2026-74846
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-208
Updated
2026-11-07
OSVDEBIAN-CVE-2026-74846 7.5

Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier. CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match. A remote attacker can use response-time differences to guess the stored password or hash.

Record
DEBIAN-CVE-2026-74846
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-08
OSVUBUNTU-CVE-2026-74846 No score

Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier. CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match. A remote attacker can use response-time differences to guess the stored password or hash.

Record
UBUNTU-CVE-2026-74846
Updated
2026-11-05

Affected packages

Affected packages
PackageAffectedFixed
libcatalyst-plugin-authentication-perl
Debian:12
 All versions, plus listed versions
0.10023-40.10024-10.10026-10.10028-10.10029-1
 None known
libcatalyst-plugin-authentication-perl
Debian:13
 All versions, plus listed versions
0.10024-10.10026-10.10028-10.10029-1
 None known
libcatalyst-plugin-authentication-perl
Debian:14
 before 0.10029-1, plus listed versions
0.10024-10.10026-10.10028-1
0.10029-1
libcatalyst-plugin-authentication-perl
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.10023-2
 None known
libcatalyst-plugin-authentication-perl
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.10023-3
 None known
libcatalyst-plugin-authentication-perl
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.10023-3
 None known
libcatalyst-plugin-authentication-perl
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.10023-3
 None known
libcatalyst-plugin-authentication-perl
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.10023-4
 None known
libcatalyst-plugin-authentication-perl
Ubuntu:26.10
 All versions, plus listed versions
0.10024-10.10026-1
 None known
libcatalyst-plugin-authentication-perl
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.10024-1
 None known

History

History
RecordedChangedSources
affected, factsOSV
affectedEUVD, GitHub Advisories, NVD, OSV
severityCVE List
publishedOSV
affected, aliases, published, referencesOSV
referencesOSV
factsNVD
affected, aliases, referencesOSV
publishedEUVD
publishedEUVD, NVD
aliases, published, referencesEUVD, GitHub Advisories
first indexedCVE List

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-74846 is a high vulnerability (CVSS 7.5) in libcatalyst-plugin-authentication-perl, published November 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 35th percentile. Fixed in libcatalyst-plugin-authentication-perl 0.10029-1.

References

Show 6 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open