CVE-2026-13410: falha de alta gravidade em GARU Dancer::Plugin::Auth::Google
Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.2epss 0.4%
Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled.
The default user agent is initialised with SSL_verify_mode explicitly disabled.
An attacker with network man-in-the-middle (MITM) capability between the Dancer application and googleapis.com can intercept the OAuth2 token exchange and userinfo fetch, return a forged access_token and user profile, and be logged in to the Dancer application as any Google user.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L
Produtos afetados
GARU · Dancer::Plugin::Auth::GoogleReferências
https://github.com/garu/Dancer-Plugin-Auth-Google/commit/2fdb72527eaa0e11a5c134c597f1e44e37411d95.patchhttps://github.com/garu/Dancer-Plugin-Auth-Google/pull/5https://metacpan.org/pod/Furl#HTTPS-requests-claims-warnings!https://metacpan.org/release/GARU/Dancer-Plugin-Auth-Google-0.08/changeshttps://security.metacpan.org/patches/D/Dancer-Plugin-Auth-Google/0.07/CVE-2026-13410-r1.patchhttp://www.openwall.com/lists/oss-security/2026/07/17/8