Catalyst::Plugin::Authentication versions before 0.10029 for Perl contain a timing attack vulnerability in the legacy password verifier. The legacy verifier uses eq comparisons for clear-text passwords, crypt hashes, and base64 digests, causing response times to vary based on matching leading bytes. This timing discrepancy allows a remote attacker to infer stored passwords or hashes. The issue was fixed in version 0.10029.