Veille CVE

Recherche « GARU Dancer::Plugin::Auth::Google »

1 CVE

Critique 0 Élevée 1 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « GARU Dancer::Plugin::Auth::Google » ✕
  1. CVE-2026-13410 8.2 Élevée

    GARU Dancer::Plugin::Auth::Google

    Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled. The default user agent is initialised with SSL_verify_mode explicitly disabled. An attacker with network man-in-the-middle (MITM) capability between the Dancer application and googleapis.com can intercept the OAuth2 token exchange and userinfo fetch, return a forged access_token and user profile, and be logged in to the Dancer application as any Google user.