CVE-2026-12746

Name of the Vulnerable Software and Affected Versions Dancer2::Plugin::Auth::OAuth::Provider versions prior to 0.23

Description The software fails to support the OAuth 2.0 state parameter. The authentication url() method creates a provider authorization redirect without a state value, and the callback() method processes the callback code and registers the token into the session without verifying if the callback corresponds to an authorization request initiated by that session. This allows for login cross-site request forgery, where an attacker can force a victim's session to associate with the attacker's provider identity and access token. If the application persists this link, the attacker may maintain access to the victim's account.

Recommendations Update to version 0.23 or later.