What is the CVSS score of CVE-2026-13410?

CVE-2026-13410 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.2%.

Which versions of Dancer are affected by CVE-2026-13410?

Dancer::Plugin::Auth::Google (all versions through 0.07) permits network attackers to forge Google login credentials and impersonate any user account, compromising the authentication mechanism for…. A patch is available.

How to fix or mitigate CVE-2026-13410?

Within 24 hours, identify all systems and applications using Dancer::Plugin::Auth::Google through version 0.07 and assess their exposure to network attacks. Within 7 days, apply the available vendor patch to restore TLS certificate validation for OAuth2 token exchanges. Within 30 days, verify all deployments are patched, review authentication logs for compromise indicators during the vulnerability window, and establish monitoring for suspicious OAuth2 authentication patterns.

Dancer CVE-2026-13410

EUVD-2026-45168 HIGH

Improper Certificate Validation (CWE-295)

2026-07-17 CPANSec

GHSA-mwgc-xrww-2crj

Information Disclosure Google Microsoft Dancer

8.2

CVSS 3.1 · Vendor: CPANSec

Severity by source

Vendor (CPANSec) PRIMARY

8.2 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L

Primary rating from Vendor (CPANSec) · only source for this CVE.

CVSS VectorVendor: CPANSec

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Source Code Evidence Fetched

Jul 17, 2026 - 18:23 vuln.today

Analysis Generated

Jul 17, 2026 - 18:23 vuln.today

CVSS changed

Jul 17, 2026 - 18:22 NVD

8.2 (HIGH)

CVE Published

Jul 17, 2026 - 12:50 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 17, 2026 - 12:50 cve.org

HIGH 8.2

DescriptionCVE.org

Dancer::Plugin::Auth::Google versions through 0.07 for Perl have TLS verification disabled.

The default user agent is initialised with SSL_verify_mode explicitly disabled.

An attacker with network man-in-the-middle (MITM) capability between the Dancer application and googleapis.com can intercept the OAuth2 token exchange and userinfo fetch, return a forged access_token and user profile, and be logged in to the Dancer application as any Google user.

AnalysisAI

Google OAuth2 login can be fully impersonated in the Perl module Dancer::Plugin::Auth::Google (all versions through 0.07) because its default user agent is initialised with SSL_verify_mode set to SSL_VERIFY_NONE, disabling TLS certificate validation on calls to googleapis.com. A network man-in-the-middle can intercept the OAuth2 token exchange and userinfo fetch and return a forged access_token and profile, authenticating as any Google user to the Dancer application. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but an upstream fix (PR #5) is available.