CVE-2026-119037

The Business::GoCardless Perl module, in versions prior to 1.01 , contains a vulnerability where it accepts forged webhooks if the configured webhook secret is undef or empty. The signature_valid function fails to reject these values, leading Digest::SHA to treat them as an empty HMAC key. This a...