https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 17:56:46 +0000 https://cve.radiocsirt.org/vuln/cve-2026-12740 <p><strong>Affected:</strong> CORNELIUS Plack::Middleware::OAuth</p> <p>Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter.</p> <p>RequestTokenV2 builds the provider authorization redirect without issuing a state value, and AccessTokenV2 exchanges the callback code and registers the resulting token into the session (register_session) without verifying that the callback corresponds to an authorization request this session initiated.</p> <p>Any application that uses this middleware for OAuth 2.0 login is exposed to login cross-site request forgery: because the callback is not bound to the session that began the flow, an attacker who starts an authorization with their own provider account can deliver the resulting callback to a victim, causing the victim&#39;s session to complete the attacker&#39;s authorization and associating the attacker&#39;s provider identity and access token with that session. Where the application persists this as an account link, the attacker may retain access to the victim&#39;s account through their own provider credentials.</p> <p><strong>Affected:</strong> CORNELIUS Plack::Middleware::OAuth</p> <p>Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter.</p> <p>RequestTokenV2 builds the provider authorization redirect without issuing a state value, and AccessTokenV2 exchanges the callback code and registers the resulting token into the session (register_session) without verifying that the callback corresponds to an authorization request this session initiated.</p> <p>Any application that uses this middleware for OAuth 2.0 login is exposed to login cross-site request forgery: because the callback is not bound to the session that began the flow, an attacker who starts an authorization with their own provider account can deliver the resulting callback to a victim, causing the victim&#39;s session to complete the attacker&#39;s authorization and associating the attacker&#39;s provider identity and access token with that session. Where the application persists this as an account link, the attacker may retain access to the victim&#39;s account through their own provider credentials.</p> https://cve.radiocsirt.org/vuln/cve-2026-12740