The vulnerability resides in Catalyst::Plugin::Authentication versions up to 0.10024 where Perl’s built‑in eq operator is used for password comparison. Timing discrepancies in this comparison can allow an attacker to infer bits of the underlying hash or password, potentially enabling credential replay or theft. This side‑channel exposure does not lead to arbitrary code execution but instead permits the gradual deduction of valid passwords through measured response times.

The affected product is Catalyst::Plugin::Authentication by JJNAPIORK. All releases through version 0.10024 are impacted, with the fix published in version 0.10026 and later.

The CVSS score of 5.1 places the vulnerability in the medium severity range, and the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The CVE is not listed in the CISA KEV catalog, suggesting no publicly known large‑scale exploitation. Nonetheless, the attack vector identified is a timing side‑channel on authentication endpoints; exploitation would require repeated credential verification attempts that expose measurable time differences, which in practice can be difficult but is feasible for determined adversaries.