CVE-2026-12740

Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter.<br /> <br /> RequestTokenV2 builds the provider authorization redirect without issuing a state value, and AccessTokenV2 exchanges the callback code and registers the resulting token into the session (register_session) without verifying that the callback corresponds to an authorization request this session initiated.<br /> <br /> Any application that uses this middleware for OAuth 2.0 login is exposed to login cross-site request forgery: because the callback is not bound to the session that began the flow, an attacker who starts an authorization with their own provider account can deliver the resulting callback to a victim, causing the victim&amp;#39;s session to complete the attacker&amp;#39;s authorization and associating the attacker&amp;#39;s provider identity and access token with that session. Where the application persists this as an account link, the attacker may retain access to the victim&amp;#39;s account through their own provider credentials.