CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match.
A remote attacker can use response-time differences to guess the stored password or hash.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to Catalyst-Plugin-Authentication 0.10029 or later.
Tracking
Sign in to view the affected projects.
No advisories yet.
Tue, 03 Nov 2026 08:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier. CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match. A remote attacker can use response-time differences to guess the stored password or hash. | |
| Title | Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier | |
| Weaknesses | CWE-208 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-11-03T07:51:25.290Z
Reserved: 2026-08-17T06:30:29.057Z
Link: CVE-2026-74846
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-11-03T08:17:15.673
Modified: 2026-11-03T16:25:21.310
Link: CVE-2026-74846
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-11-03T10:00:15Z