CVE-2026-13410: Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled
Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled.
The default user agent is initialised with SSLverifymode explicitly disabled.
An attacker with network man-in-the-middle (MITM) capability between the Dancer application and googleapis.com can intercept the OAuth2 token exchange and userinfo fetch, return a forged accesstoken and user profile, and be logged in to the Dancer application as any Google user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dancer::Plugin::Auth::Google (Perl)to a version that resolves this vulnerability.Fixed in 0.08
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13410?
CVE-2026-13410 has a risk rating of 30, indicating a significant vulnerability in Dancer::Plugin::Auth::Google.
How do I fix CVE-2026-13410?
To fix CVE-2026-13410, upgrade Dancer::Plugin::Auth::Google to version 0.08 or later, where TLS verification is enabled.
What impact does CVE-2026-13410 have on my application?
CVE-2026-13410 allows attackers with MITM capabilities to intercept communications between your application and Google APIs.
Which versions of Dancer::Plugin::Auth::Google are affected by CVE-2026-13410?
CVE-2026-13410 affects all versions of Dancer::Plugin::Auth::Google through version 0.07.
What is the root cause of CVE-2026-13410?
The root cause of CVE-2026-13410 is that the default user agent is initialized with SSL verification explicitly disabled.