CVE-2026-12746

The Dancer2::Plugin::Auth::OAuth::Provider Perl plugin (versions before 0.23 ) lacks support for the OAuth 2.0 state parameter . Specifically, the authentication_url method fails to issue a state value, and the callback method registers tokens without verifying that the callback matches the sessi...