Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-74846— Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier

Quick assessment

Affected
CVE-2026-74846
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 语言中，Catalyst::Plugin::Authentication 0.10029 版本之前的版本存在漏洞：由于遗留密码验证器（legacy password verifier）在比对密码时使用了 操作符，攻击者可利用时序差异对已存储的密码发起时序攻击。 CVE-2026-5091 已在基于 Realm 的验证器中得到修复。然而，该遗留验证器仍由已弃用的登录方法使用，其通过 操作符对明文密码、crypt 哈希值以及 Base64 编码的摘要进行比对；由于 的比对耗时取决于匹配的前导字节数量，因此比较

AI Predicted 5.3 Difficulty: Moderate EPSS 0.27% · P20

Possible ATT&CK Techniques 1 AI

T1110.001 · Password Guessing

I. Basic Information for CVE-2026-74846

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier
Source: CVE Program / CVE List V5
Vulnerability Description
Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier. CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match. A remote attacker can use response-time differences to guess the stored password or hash.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
通过时间差异性导致的信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 0.10029 -

II. Public POCs for CVE-2026-74846

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-74846

请登录查看更多情报信息。

Other References for CVE-2026-74846 (3)

IV. Related Vulnerabilities

Same weakness: CWE-208