{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3acatalyst_projectcatalyst-plugin-authenticationperl/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:catalyst_project:catalyst-plugin-authentication:*:*:*:*:*:perl:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-74846"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Catalyst::Plugin::Authentication (\u003c 0.10029)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Catalyst::Plugin::Authentication module for Perl contains a vulnerability in its legacy password verifier that allows remote timing attacks. The legacy verifier, utilized by a deprecated login method, performs password comparisons using the Perl 'eq' operator. Because this operator exits early when a mismatch is found, the total execution time of the comparison varies based on the number of matching leading bytes. An attacker can exploit these response-time differences to perform statistical analysis and recover stored passwords or password hashes.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows remote attackers to recover stored credentials or password hashes through iterative measurement of authentication response times.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Catalyst::Plugin::Authentication package to version 0.10029 or later to remove the vulnerable legacy verifier.\u003c/li\u003e\n\u003cli\u003eIdentify and migrate any applications or modules currently utilizing the deprecated 'login' method to the modern, realm-based verifier which is not subject to this vulnerability.\u003c/li\u003e\n\u003cli\u003eMonitor authentication logs for high volumes of login requests originating from a single source or targeting specific accounts, which may indicate an ongoing timing attack.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-06T21:29:25Z","date_published":"2026-11-06T21:29:25Z","id":"https://feed.craftedsignal.io/briefs/2026-11-catalyst-auth-timing-attack/","summary":"Catalyst::Plugin::Authentication for Perl versions prior to 0.10029 are vulnerable to remote timing attacks due to insecure string comparison operators in the legacy password verifier.","title":"Catalyst::Plugin::Authentication: Timing attack vulnerability in legacy password verifier (CVE-2026-74846)","url":"https://feed.craftedsignal.io/briefs/2026-11-catalyst-auth-timing-attack/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:catalyst_project:catalyst-Plugin-Authentication:*:*:*:*:*:perl:*:*","version":"https://jsonfeed.org/version/1.1"}