Security Advisories (1)
CVE-2026-5091 (2026-05-21)

Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks. These versions use Perl's built-in eq comparison. Discrepencies in timing could be used to guess the underlying hash or password.

NAME

Catalyst::Authentication::User::Hash - An easy authentication user object based on hashes.

SYNOPSIS

use Catalyst::Authentication::User::Hash;

Catalyst::Authentication::User::Hash->new(
    password => "s3cr3t",
);

DESCRIPTION

This implementation of authentication user handles is supposed to go hand in hand with Catalyst::Authentication::Store::Minimal.

METHODS

new( @pairs )

Create a new object with the key-value-pairs listed in the arg list.

supports( )

Checks for existence of keys that correspond with features.

for_session( )

Just returns $self, expecting it to be serializable.

from_session( )

Just passes returns the unserialized object, hoping it's intact.

AUTOLOAD( )

Accessor for the key whose name is the method.

store( )

Accessors that override superclass's dying virtual methods.

id( )

can( )

SEE ALSO

Hash::AsObject