CVE-2026-12746

The Dancer2::Plugin::Auth::OAuth::Provider Perl plugin, in versions prior to 0.23 , fails to support the OAuth 2.0 state parameter . The authentication_url method fails to issue a state value, and the callback method registers tokens without verifying that the callback corresponds to a session-in...