Business::GoCardless for Perl versions earlier than 1.01 fails to validate the session token when confirming a redirect flow. The module reads a redirect flow from the GoCardless API and completes it using the token supplied in that response, bypassing any check that the session completing the flow matches the original session. As a result, an attacker who obtains a redirected flow ID can trigger the flow to be confirmed and create a payment or subscription against the customer's mandate. This creates an authorization bypass that permits unauthorized financial transactions, undermining the integrity of the payment system.

The affected product is the Business::GoCardless Perl module, with all releases prior to version 1.01. In these versions the confirm_redirect_flow routine does not enforce session token verification, allowing the flow ID to be used by any party who can supply it. No other vendors or products are affected according to the CNA data.

The vulnerability has no EPSS score and is not listed in CISA KEV, but its severity is driven by the capacity to generate payments without legitimate authorization. An attacker only needs to learn or predict a customer's redirect flow identifier, a task that may be accomplished through phishing, exposed API credentials, or other means. Once the identifier is known, the module will auto‑confirm the flow and create a new payment or subscription with no further authentication, enabling remote exploitation over the network. Because of the direct monetary loss potential, the risk to affected organizations is high.