CVE-2026-13410CWE-295

CVE-2026-13410

High · published July 17, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
31.1
In the wild
Unconfirmed
What it is

Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled.

The default user agent is initialised with SSL_verify_mode explicitly disabled.

An attacker with network man-in-the-middle (MITM) capability between the Dancer application and googleapis.com can intercept the OAuth2 token exchange and userinfo fetch, return a forged access_token and user profile, and be logged in to the Dancer application as any Google user.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00383 · 31.1th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2026-07-17T17:17Z
References (6)
https://github.com/garu/Dancer-Plugin-Auth-Google/commit/2fdb72527eaa0e11a5c134c597f1e44e37411d95.patch · 9b29abf9-4ab0-4765-b253-1875cd9b441ehttps://github.com/garu/Dancer-Plugin-Auth-Google/pull/5 · 9b29abf9-4ab0-4765-b253-1875cd9b441ehttps://metacpan.org/pod/Furl#HTTPS-requests-claims-warnings! · 9b29abf9-4ab0-4765-b253-1875cd9b441ehttps://metacpan.org/release/GARU/Dancer-Plugin-Auth-Google-0.08/changes · 9b29abf9-4ab0-4765-b253-1875cd9b441ehttps://security.metacpan.org/patches/D/Dancer-Plugin-Auth-Google/0.07/CVE-2026-13410-r1.patch · 9b29abf9-4ab0-4765-b253-1875cd9b441ehttp://www.openwall.com/lists/oss-security/2026/07/17/8 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 17 JUL 12:50Z
    Dancer::Plugin::Auth::Google versions through 0.07 for Perl have TLS verification disabled
    cvelistv5