CVE-2026-13410 json
Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled
published 2026-07-17 3 mo ago modified 2026-10-24 15 d ago also EUVD-2026-45168
- cvss
- 8.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 32%
- public exploits
- 0
- none known
Summary
Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled.
The default user agent is initialised with SSL_verify_mode explicitly disabled.
An attacker with network man-in-the-middle (MITM) capability between the Dancer application and googleapis.com can intercept the OAuth2 token exchange and userinfo fetch, return a forged access_token and user profile, and be logged in to the Dancer application as any Google user.
Patch / fix
- GARU Dancer::Plugin::Auth::Google 0.08
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 3 mo ago
Exploit prediction
0.38% chance of exploitation in the next 30 days, higher than 32% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L |
| CNA | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L |
Affected products
- GARU Dancer::Plugin::Auth::Google
Classification
- Weakness
-
- CWE-295 Improper Certificate Validation
References
-
github.com
/garu/Dancer-Plugin-Auth-Google/commit/2fdb72527eaa0e11a5c134c597f1e44e37411d95.patch
patch
-
github.com
/garu/Dancer-Plugin-Auth-Google/pull/5
issue-tracking
-
security.metacpan.org
/patches/D/Dancer-Plugin-Auth-Google/0.07/CVE-2026-13410-r1.patch
patch
-
metacpan.org
/release/GARU/Dancer-Plugin-Auth-Google-0.08/changes
release-notes
-
metacpan.org
/pod/Furl#HTTPS-requests-claims-warnings!
technical-description
- openwall.com /lists/oss-security/2026/07/17/8
Sources
- CVE List CVE-2026-13410
- NVD CVE-2026-13410
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.