CVE-2026-119038 Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another customer's mandate

[
  {
    "collectionURL": "https://cpan.org/modules",
    "defaultStatus": "unaffected",
    "modules": [
      "Business::GoCardless"
    ],
    "packageName": "Business-GoCardless",
    "packageURL": "pkg:cpan/Business-GoCardless",
    "programFiles": [
      "lib/Business/GoCardless/Pro.pm",
      "lib/Business/GoCardless/Client.pm"
    ],
    "programRoutines": [
      {
        "name": "Business::GoCardless::Pro::confirm_resource"
      },
      {
        "name": "Business::GoCardless::Client::_confirm_redirect_flow"
      }
    ],
    "repo": "https://github.com/payprop/business-gocardless",
    "versions": [
      {
        "lessThan": "1.01",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]