Business::GoCardless versions before 1.01 for Perl accept forged webhooks if the configured webhook secret is undefined or empty. This occurs because the signature validation function does not reject empty or undefined secrets, allowing an attacker to forge webhook signatures using an empty key.