EUVD-2026-41687
GHSA-rfx5-x6rx-6w25
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Network reachable and low complexity with no attacker auth (PR:N), but the callback must be delivered to a victim (UI:R); resulting account link grants high confidentiality/integrity impact and no availability effect.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
7Description PRE-NVD
AnalysisAI
Login cross-site request forgery in Plack::Middleware::OAuth through 0.10 (Perl/PSGI OAuth login middleware) lets an unauthenticated remote attacker bind their own provider identity to a victim's session because the OAuth 2.0 flow omits the anti-CSRF state parameter and never verifies that a callback belongs to the session that initiated the flow. With victim interaction (clicking an attacker-supplied callback URL), the attacker's provider account and access token become associated with the victim's session, and where the app persists this as an account link the attacker retains ongoing access to the victim's account. There is no public exploit identified at time of analysis; EPSS is low (0.13%) and it is not in CISA KEV, but an upstream fix exists in PR #13.
Technical ContextAI
The affected component is Plack::Middleware::OAuth, a Perl PSGI middleware (distributed on CPAN by author c9s) that implements OAuth 1.0/2.0 login handling for Plack-based web applications. The root cause is CWE-352 (Cross-Site Request Forgery): in the OAuth 2.0 handlers, RequestTokenV2 constructs the provider authorization redirect without generating a state value, and AccessTokenV2 exchanges the returned authorization code and calls register_session to install the resulting token without checking that the callback corresponds to an authorization request the current session started. RFC 6749 §10.12 specifies the state parameter precisely to bind the authorization request to the user-agent's authenticated state and prevent this login-CSRF class; the upstream patch (PR #13) adds a CSPRNG-generated state (via Crypt::SysRandom random_bytes) stored in the Plack::Session keyed by provider in RequestTokenV2, and a strict equality check with removal on the callback in AccessTokenV2, also raising the Plack::Middleware::Session dependency to 0.35.
RemediationAI
Upstream fix available (PR/commit); a released patched version is not independently confirmed from the provided data, so apply the fix from GitHub PR #13 (https://github.com/c9s/Plack-Middleware-OAuth/pull/13) or the official patch at https://security.metacpan.org/patches/P/Plack-Middleware-OAuth/0.10/CVE-2026-12740-r1.patch, which adds CSPRNG-backed state generation/validation and requires Plack::Middleware::Session >= 0.35 plus Crypt::SysRandom; watch CPAN (https://metacpan.org/dist/Plack-Middleware-OAuth) for a tagged release above 0.10 and track RT ticket https://rt.cpan.org/Ticket/Display.html?id=179874 and the oss-security advisory https://seclists.org/oss-sec/2026/q3/27. If you cannot patch immediately, compensating controls include implementing the RFC 6749 §10.12 state check in a wrapping layer or reverse proxy that injects and verifies a per-session state parameter on the authorization and callback URLs (trade-off: custom code that must exactly match provider redirect handling), disabling OAuth 2.0 login and falling back to another authentication method (trade-off: loss of social login for users), and, for apps that auto-link identities, disabling automatic account linking so a callback cannot silently attach a provider identity to an existing session (trade-off: extra manual linking step for legitimate users).
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today