TI-2026-11356 Aliases CVE-2026-13410 GHSA-mwgc-xrww-2crj

Improper certificate validation in GARU Dancer::Plugin::Auth::Google

MEDIUM 42CWE-295Published 2026-07-17 · Updated 2026-08-11

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: High
Impact type: Spoofing
Confidentiality · integrity · availability: High · High · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-295.

Summary

Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled. The default user agent is initialised with SSL_verify_mode explicitly disabled. An attacker with network man-in-the-middle (MITM) capability between the Dancer application and googleapis.com can intercept the OAuth2 token exchange and userinfo fetch, return a forged access_token and user profile, and be logged in to the Dancer application as any Google user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00383 32nd percentileScored 2026-11-07

Fix Fixed Dancer::Plugin::Auth::Google (GARU): 0.08

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
GARU	Dancer::Plugin::Auth::Google	before 0.08	0.08	Patch available	CNA

Dancer::Plugin::Auth::Google VendorGARU Affected before 0.08 Fixed in 0.08 Patch available CNA

Remediation

Fix · CNA Dancer::Plugin::Auth::Google (GARU) Fixed in 0.08

Timeline

2026-10-02 Threatist record created from CVE-2026-13410
2026-10-03 Alias added: GHSA-mwgc-xrww-2crj

References

Patch 2

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences