CVE-2026-12740

Name of the Vulnerable Software and Affected Versions Plack::Middleware::OAuth versions prior to 0.11

Description Plack::Middleware::OAuth for Perl fails to support the OAuth 2.0 state parameter. The RequestTokenV2 function builds the provider authorization redirect without issuing a state value, and the AccessTokenV2 function exchanges the callback code and registers the token into the session via register session() without verifying if the callback corresponds to an authorization request initiated by that session. This allows for login cross-site request forgery, where an attacker can force a victim's session to associate with the attacker's provider identity and access token. If the application persists this link, the attacker may maintain access to the victim's account.

Recommendations Update Plack::Middleware::OAuth to version 0.11 or later.