CyberRota Analysis
AI-GeneratedDancer::Plugin::Auth::Google versions up to 0.07 for Perl have a critical vulnerability due to TLS verification being disabled, allowing an attacker with man-in-the-middle capabilities to intercept OAuth2 token exchanges. This can lead to unauthorized access, enabling the attacker to impersonate any Google user within the Dancer application. Organizations using this plugin should prioritize immediate updates to mitigate the risk of credential theft and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled. The default user agent is initialised with SSL_verify_mode explicitly disabled. An attacker with network man-in-the-middle (MITM) capability between the Dancer application and googleapis.com can intercept the OAuth2 token exchange and userinfo fetch, return a forged access_token and user profile, and be logged in to the Dancer application as any Google user.