CVE-2026-12746

Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 state parameter. The authenticationurl method builds the provider authorization redirect without issuing a state value, and the callback method exchanges the callback code and registers the resulting...

Paulo Ferreira Dancer2::Plugin::Auth::OAuth::Provider cross-site request forgery vulnerability

Versions prior to 0.23 of Dancer2::Plugin::Auth::OAuth::Provider contain a cross-site request forgery vulnerability. This vulnerability stems from the lack of support for the OAuth 2.0 state parameter; the authenticationurl method fails to generate a state value when constructing authorization...

CVE-2026-12746: Cross-Site Request Forgery (CSRF)

Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 state parameter. The authenticationurl method builds the provider authorization redirect without issuing a state value, and the callback method exchanges the callback code and registers the resulting...