CVE-2026-12746

The Dancer2::Plugin::Auth::OAuth::Provider Perl plugin (versions before 0.23 ) lacks support for the OAuth 2.0 state parameter . Specifically, the authentication_url method fails to issue a state value, and the callback method registers tokens without verifying that the callback matches the sessi...

CVE-2026-9733 Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter

Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter. When no state generator is specified in the constructor, the module defaults to using a SHA-1 hash of predictable and low-entropy sources, including the epoch time which is leaked via t...