/ 
Catalyst-Plugin-Authentication-0.10001
/ Catalyst::Plugin::Authentication::User::Hash
Security Advisories (2)
CVE-2026-5091 (2026-05-21)

Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks. These versions use Perl's built-in eq comparison. Discrepencies in timing could be used to guess the underlying hash or password.

CVE-2009-10007 (2026-06-09)

Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks. Catalyst::Plugin::Authentication does not automatically change the session id after authentication. An attacker that obtains a session id cookie can use this to impersonate the victim.

NAME

Catalyst::Plugin::Authentication::User::Hash - An easy authentication user object based on hashes.

SYNOPSIS

use Catalyst::Plugin::Authentication::User::Hash;

Catalyst::Plugin::Authentication::User::Hash->new(
	password => "s3cr3t",
);

DESCRIPTION

This implementation of authentication user handles is supposed to go hand in hand with Catalyst::Plugin::Authentication::Store::Minimal.

METHODS

new @pairs

Create a new object with the key-value-pairs listed in the arg list.

supports

Checks for existence of keys that correspond with features.

for_session

Just returns $self, expecting it to be serializable.

from_session

Just passes returns the unserialized object, hoping it's intact.

AUTOLOAD

Accessor for the key whose name is the method.

id
store

Accessors that override superclass's dying virtual methods.

SEE ALSO

Hash::AsObject