EUVD-2026-41686
GHSA-3f6x-q3gv-gmfc
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Network-delivered, no attacker privileges required (PR:N), but victim must visit crafted URL (UI:R); account takeover crosses scope boundary (S:C) with full confidentiality and integrity loss, no availability impact.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
2Description PRE-NVD
AnalysisAI
Login CSRF via a missing OAuth 2.0 state parameter in Dancer2::Plugin::Auth::OAuth::Provider (all versions before 0.23) allows a remote, unauthenticated attacker to associate their own OAuth provider identity and access token with a victim's application session, potentially achieving persistent account takeover. The plugin's authentication_url method never generates a state value, and the callback handler never validates one, leaving the entire authorization flow unbound to the session that initiated it. No public exploit code or active exploitation (CISA KEV) has been identified, but the attack concept is well-understood and described in RFC 6749 §10.12 as a known threat to any OAuth 2.0 implementation omitting state binding.
Technical ContextAI
Dancer2::Plugin::Auth::OAuth is a Perl CPAN distribution that integrates OAuth 2.0 third-party authentication into applications built on the Dancer2 web framework. The OAuth 2.0 Authorization Framework (RFC 6749) mandates that clients generate an opaque, unguessable state value before redirecting users to the authorization server, then verify that value upon receiving the authorization callback - this is the primary CSRF protection mechanism defined in §10.12 of the RFC. The vulnerable plugin's authentication_url method omits state generation entirely, and the callback method accepts any inbound authorization code without verifying it corresponds to a flow this session initiated. The root cause class is CWE-352 (Cross-Site Request Forgery), manifesting as Login CSRF or OAuth callback injection: a variant that does not require the victim to perform any authenticated action in the target application, but instead causes the victim's browser to complete an attacker-controlled authorization flow, permanently associating the attacker's provider credentials with the victim's account.
RemediationAI
Upgrade Dancer2-Plugin-Auth-OAuth to version 0.23 or later via CPAN (cpanm Dancer2::Plugin::Auth::OAuth or cpan Dancer2-Plugin-Auth-OAuth). The fixed release BIAFRA/Dancer2-Plugin-Auth-OAuth-0.23 was published 2026-06-22; the changes are visible at the MetaCPAN diff (https://metacpan.org/release/BIAFRA/Dancer2-Plugin-Auth-OAuth-0.23/diff/BIAFRA/Dancer2-Plugin-Auth-OAuth-0.22) and the underlying patch is at the GitHub commit https://github.com/biafra/perl-Dancer2-Plugin-Auth-OAuth/commit/806420fc2abbe13bede4461475f2f3dcd7daf5f2. If an immediate upgrade is not feasible, the only viable compensating control is to disable OAuth login entirely and require alternative authentication methods (local credentials, SSO via a different mechanism); this eliminates the attack surface completely but removes social login functionality for all users. There is no partial mitigation that preserves OAuth login without implementing the state parameter, because the missing protection is architectural - no WAF rule or network control can substitute for server-side session binding.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today