CVE-2026-5091

Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks

5.1 MediumFix available

Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks.

These versions use Perl's built-in eq comparison. Discrepencies in timing could be used to guess the underlying hash or password.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.20%Up 0.2 points since May 22, 2026

What each source reports

CVE List Score used 5.1

Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks

Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks.

These versions use Perl's built-in eq comparison. Discrepencies in timing could be used to guess the underlying hash or password.

Record: CVE-2026-5091
CVSS 3.1: 5.1 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-208
Updated: 2026-11-02

EUVDEUVD-2026-31353 5.1

Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks.

These versions use Perl's built-in eq comparison. Discrepencies in timing could be used to guess the underlying hash or password.

Record: EUVD-2026-31353
CVSS 3.1: 5.1 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-37jv-v9vv-wxwv 5.1

Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing...

Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks.

These versions use Perl's built-in eq comparison. Discrepencies in timing could be used to guess the underlying hash or password.

Record: GHSA-37jv-v9vv-wxwv
CVSS 3.1: 5.1 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-208
Updated: 2026-11-02

NVD 5.1

Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks.

These versions use Perl's built-in eq comparison. Discrepencies in timing could be used to guess the underlying hash or password.

Record: CVE-2026-5091
CVSS 3.1: 5.1 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-208
Updated: 2026-11-02

OSV 5.1

Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks

Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks.

These versions use Perl's built-in eq comparison. Discrepencies in timing could be used to guess the underlying hash or password.

Record: CVE-2026-5091
CVSS 3.1: 5.1 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-208
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-5091 5.1

Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks. These versions use Perl's built-in eq comparison. Discrepencies in timing could be used to guess the underlying hash or password.

Record: DEBIAN-CVE-2026-5091
CVSS 3.1: 5.1 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-5091 5.1

Record: UBUNTU-CVE-2026-5091
CVSS 3.1: 5.1 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVMGASA-2026-0160 No score

Updated perl-Catalyst-Plugin-Authentication package fixes a security vulnerability

The updated package fixes a security vulnerability: Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks. (CVE-2026-5091)

Record: MGASA-2026-0160
Updated: 2026-11-02

Affected products

jjnapiork catalyst::plugin::authentication

Affected packages

Affected packages
Package	Affected	Fixed
`libcatalyst-plugin-authentication-perl` Debian:12	All versions, plus listed versions 0.10023-40.10024-10.10026-10.10028-1	None known
`libcatalyst-plugin-authentication-perl` Debian:13	All versions, plus listed versions 0.10024-10.10026-10.10028-1	None known
`libcatalyst-plugin-authentication-perl` Debian:14	before 0.10026-1, plus listed versions 0.10024-1	0.10026-1
`perl-Catalyst-Plugin-Authentication` Mageia:9	before 0.100.230-12.1.mga9	0.100.230-12.1.mga9
`libcatalyst-plugin-authentication-perl` Ubuntu:16.04:LTS	All versions, plus listed versions 0.10023-2	None known
`libcatalyst-plugin-authentication-perl` Ubuntu:18.04:LTS	All versions, plus listed versions 0.10023-3	None known
`libcatalyst-plugin-authentication-perl` Ubuntu:20.04:LTS	All versions, plus listed versions 0.10023-3	None known
`libcatalyst-plugin-authentication-perl` Ubuntu:22.04:LTS	All versions, plus listed versions 0.10023-3	None known
`libcatalyst-plugin-authentication-perl` Ubuntu:24.04:LTS	All versions, plus listed versions 0.10023-4	None known
`libcatalyst-plugin-authentication-perl` Ubuntu:25.10	All versions, plus listed versions 0.10024-1	None known
`libcatalyst-plugin-authentication-perl` Ubuntu:26.10	All versions, plus listed versions 0.10024-10.10026-1	None known
`libcatalyst-plugin-authentication-perl` Ubuntu:26.04:LTS	All versions, plus listed versions 0.10024-1	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-5091 is a medium vulnerability (CVSS 5.1) in Jjnapiork Catalyst::plugin::authentication, published May 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 9th percentile. Fixed in libcatalyst-plugin-authentication-perl 0.10026-1.

References

Show 9 moreShow less