Catalyst::Plugin::Authentication: Timing attack vulnerability in legacy password verifier (CVE-2026-74846)

The Catalyst::Plugin::Authentication module for Perl contains a vulnerability in its legacy password verifier that allows remote timing attacks. The legacy verifier, utilized by a deprecated login method, performs password comparisons using the Perl 'eq' operator. Because this operator exits early when a mismatch is found, the total execution time of the comparison varies based on the number of matching leading bytes. An attacker can exploit these response-time differences to perform statistical analysis and recover stored passwords or password hashes.

Impact

Successful exploitation allows remote attackers to recover stored credentials or password hashes through iterative measurement of authentication response times.

Recommendation

• Update the Catalyst::Plugin::Authentication package to version 0.10029 or later to remove the vulnerable legacy verifier.
• Identify and migrate any applications or modules currently utilizing the deprecated 'login' method to the modern, realm-based verifier which is not subject to this vulnerability.
• Monitor authentication logs for high volumes of login requests originating from a single source or targeting specific accounts, which may indicate an ongoing timing attack.