Paulo A Ferreira

**Name of the Vulnerable Software and Affected Versions** Dancer2::Plugin::Auth::OAuth::Provider versions prior to 0.23 **Description** The software fails to support the OAuth 2.0 state parameter. The `authentication url()` method creates a provider authorization redirect without a state value, and the `callback()` method processes the callback code and registers the token into the session without verifying if the callback corresponds to an authorization request initiated by that session. This allows for login cross-site request forgery, where an attacker can force a victim's session to associate with the attacker's provider identity and access token. If the application persists this link, the attacker may maintain access to the victim's account. **Recommendations** Update to version 0.23 or later.