Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-119038— Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another customer's mandate

Quick assessment

Affected
CVE-2026-119038
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Perl 的 Business::GoCardless 模块中，1.01 版本之前的版本在执行重定向流程时未验证会话令牌，导致泄露的重定向流程 ID 可被用于在另一客户的授权（mandate）下创建支付。 具体而言， 方法并未从调用方获取会话令牌。它会从 GoCardless API 重新读取重定向流程，并使用该响应中的令牌完成流程，因此“流程必须由发起它的同一会话完成”的校验始终通过。随后，该方法会基于该流程的授权创建所请求的支付或订阅。自 1.00 版本起，若流程已关联授权，则直接返回“已确认”状态而不再重

AI Predicted 7.5 Difficulty: Moderate

I. Basic Information for CVE-2026-119038

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another customer's mandate
Source: CVE Program / CVE List V5
Vulnerability Description
Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another customer's mandate. confirm_resource takes no session token from the caller. It reads the redirect flow back from the GoCardless API and completes it with the token from that response, so the check that the flow is completed by the session that started it always passes. It then creates the requested payment or subscription against the flow's mandate. Since version 1.00, a flow that already has a mandate is returned as confirmed without being completed again, so the same ID creates a new payment on every call. A remote attacker who obtains another customer's redirect flow ID can create payments or subscriptions against that customer's mandate.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 1.01 -

II. Public POCs for CVE-2026-119038

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-119038

请登录查看更多情报信息。

Other References for CVE-2026-119038 (1)

IV. Related Vulnerabilities

Same weakness: CWE-639