Catalyst::Plugin::Authentication CVE-2026-5091

The attacker must be able to submit a large volume of authentication requests - typically hundreds to thousands per character position - to the Catalyst application's login endpoint and measure response times with sub-millisecond precision. The application must be using Catalyst::Plugin::Authentication with the Password credential type in any supported mode (plaintext, crypt, MD5 hex, or MD5 Base64). No prior authentication is required to reach the login endpoint. Exploitation is severely limited by: (1) network jitter and server processing variance, which obscure the timing signal in most production environments; (2) server-side load variability from concurrent requests; (3) the non-automatable nature confirmed by SSVC, requiring targeted manual orchestration rather than commodity tooling. The AV:L classification in the provided CVSS vector suggests the vendor considers reliable exploitation to require local or co-located access for timing precision.

The provided CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, score 5.1) classifies this as a local attack, which is conservative for a web authentication module - timing attacks against HTTP endpoints are typically network-reachable. AC:H accurately captures the statistical difficulty: an attacker needs hundreds to thousands of requests per character position and sub-millisecond timing resolution. EPSS at 0.01% (2nd percentile) and SSVC exploitation status of none confirm no observed exploitation activity. Technical impact is partial per SSVC, consistent with confidentiality-only CVSS impact (C:H/I:N/A:N). The non-automatable SSVC designation reflects the high measurement complexity. Real-world risk is low: production server load variance, network jitter, and the volume of requests required make exploitation operationally difficult outside co-located or low-latency network environments. This is a genuine cryptographic hygiene issue but not an emergency remediation priority given the evidence profile.

An attacker submits thousands of login attempts to a Catalyst application, systematically varying candidate password strings one character at a time and precisely measuring HTTP response latencies for each. By aggregating timing distributions per character position against the eq comparison in Catalyst::Authentication::Credential::Password, the attacker statistically identifies which characters produce longer comparison times (more matching leading bytes), progressively reconstructing the stored password hash or plaintext. No public exploit code has been identified at time of analysis; successful exploitation requires co-location or a low-jitter network path and is not automatable at scale.