CVE-2026-74846

The record

Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier. CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match. A remote attacker can use response-time differences to guess the stored password or hash.

Affected packages

Related vulnerabilities

• CVE-2026-63410 secp256k1-native is a native C secp256k1 implementation for Ruby. CWE-208
• CVE-2026-62860 Picsou is a self-hosted personal finance dashboard. CWE-208
• CVE-2026-93434 An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process… CWE-208
• CVE-2026-65630 Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a… CWE-208
• CVE-2026-87946 Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows… CWE-208
• CVE-2026-49265 OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. CWE-208
• CVE-2026-18040 In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side… CWE-208
• CVE-2026-18036 In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in… CWE-208