The vulnerability CVE-2026-5091 affects Catalyst::Plugin::Authentication versions up to 0.10024. It arises from the use of Perl's built-in eq operator for string comparison, which can introduce observable timing discrepancies. These timing differences can potentially be exploited by an attacker to guess sensitive authentication data such as hashes or passwords. The vulnerability is categorized under CWE-208 (Observable Timing Discrepancy). No CVSS score or vendor remediation information is currently provided.

An attacker could leverage timing discrepancies in authentication comparisons to infer sensitive information like passwords or hashes. This could lead to unauthorized access if the attacker successfully reconstructs authentication credentials. However, there are no known exploits in the wild, and the impact depends on the attacker's ability to measure timing differences accurately.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing constant-time comparison functions to replace Perl's built-in eq operator in authentication routines to mitigate timing attacks.