CVE-2026-5091 Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks
Attackers can exploit timing discrepancies in password comparison to guess hashes or passwords in the Catalyst authentication plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-5091?
CVE-2026-5091 is a medium-severity vulnerability in JJNAPIORK Catalyst::Plugin::Authentication, published on 21 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks.
These versions use Perl's built-in eq comparison. Discrepencies in timing could be used to guess the underlying hash or password.
Weakness: CWE-208
Which versions are affected by CVE-2026-5091?
How do I fix CVE-2026-5091?
Apply the vendor's patch.
Is CVE-2026-5091 being exploited?
There is no known exploitation of CVE-2026-5091 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-5091, GHSA-37jv-v9vv-wxwv, MGASA-2026-0160, UBUNTU-CVE-2026-5091.