Business::GoCardless, a Perl module used to integrate GoCardless payment services, has a flaw in versions earlier than 1.01 that allows it to accept forged webhook notifications when the configured webhook secret is undefined or empty. The module utilizes the configured secret as the HMAC key for signature validation, and it fails to reject an undefined or empty secret; Digest::SHA treats such values as an empty key, which means a request signed with an empty key passes validation. An attacker can therefore create a webhook payload, sign it using an empty key, and send it to a system that relies on Business::GoCardless for payment processing, causing the system to process the request as if it came from GoCardless.

The affected product is the Business::GoCardless Perl module. Vulnerable versions are all releases before 1.01. Systems using earlier versions with an undefined or empty secret—whether from an unset environment variable or an empty entry in the rotated secrets list—are at risk. Updated versions 1.01 and later include a fix that checks for a defined, non‑empty secret before accepting webhooks.

The weakness is categorized as CWE-347, reflecting improper validation of application data. Because the attack requires an external webhook source, the vector is remote network traffic, and the exploitability is high if an attacker can deploy a forged payload. The EPSS score is not available, and the vulnerability has not been listed in the CISA KEV catalog, but the lack of a secret is a severe configuration issue that could lead to unauthorized processing.