CVE-2026-12740

Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter. RequestTokenV2 builds the provider authorization redirect without issuing a state value, and AccessTokenV2 exchanges the callback code and registers the resulting token into the session...

c9s Plack::Middleware::OAuth cross-site request forgery vulnerability

Versions 0.10 and earlier of c9s Plack::Middleware::OAuth contain a cross-site request forgery vulnerability. This vulnerability stems from the lack of support for OAuth 2.0 state parameters; RequestTokenV2 fails to generate a state value when constructing redirects, and AccessTokenV2 does not...

CVE-2026-12740: Cross-Site Request Forgery (CSRF)

Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter. RequestTokenV2 builds the provider authorization redirect without issuing a state value, and AccessTokenV2 exchanges the callback code and registers the resulting token into the session...