CVE-2026-119038 — Business::GoCardless versions before 1.01 complete redirect flows without checking the session token, letting…

CVE-2026-119038 affects Business::GoCardless versions before 1.01. These versions complete redirect flows without checking the session token. The source associates the issue with CWE-639: Authorization Bypass Through User-Controlled Key.