https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T18:28:55.425057+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-13410 CVE-2026-13410 — Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled 2026-10-09T18:28:55.443382+00:00

Affected: GARU Dancer::Plugin::Auth::Google

Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled.

The default user agent is initialised with SSL_verify_mode explicitly disabled.

An attacker with network man-in-the-middle (MITM) capability between the Dancer application and googleapis.com can intercept the OAuth2 token exchange and userinfo fetch, return a forged access_token and user profile, and be logged in to the Dancer application as any Google user.