Business::GoCardless vulnerabilities

Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another customer's mandate. confirm_resource takes no session token from the caller and always accepts the flow, and since version 1.00 a flow with a mandate is returned as confirmed without being completed again.

Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty. signature_valid uses each configured secret as the HMAC key, and Digest::SHA treats undef and an empty string as an empty key.

Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature. A payload with a top-level "payload" key is flattened into key-value pairs, where a long key holding a long array costs memory proportional to the key length times the array length.