CVE-2026-13410

Name of the Vulnerable Software and Affected Versions Dancer::Plugin::Auth::Google versions prior to 0.08

Description TLS verification is disabled because the default user agent is initialized with SSL verify mode explicitly disabled. This allows an attacker with network man-in-the-middle (MITM) capability—a position where the attacker can intercept and relay communications between two parties—between the Dancer application and googleapis.com to intercept the OAuth2 token exchange and userinfo fetch. Consequently, the attacker can return a forged access token and user profile to log in to the Dancer application as any Google user.

Recommendations Update Dancer::Plugin::Auth::Google to version 0.08 or later.