CVE-2026-13410Disclosure

LOWCVSS 8.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled. The default user agent is initialised with SSL_verify_mode explicitly disabled. An attacker with network man-in-the-middle (MITM) capability between the Dancer application and googleapis.com can intercept the OAuth2 token exchange and userinfo fetch, return a forged access_token and user profile, and be logged in to the Dancer application as any Google user.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-295

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets2 URLs

By indicator

Full discourse1 post

Open Source Security mailing list@oss_security92d
Disclosure
Perl CPAN CVE-2026-13410: Dancer::Plugin::Auth::Google through 0.07 have TLS verification disabled https://www.openwall.com/lists/oss-security/2026/07/17/8 CVE-2026-13082: GD::SecurityImage through 1.75 use rand to generate secrets https://www.openwall.com/lists/oss-security/2026/07/17/9
Post summary
Two Perl CPAN modules are reported with CVEs – one affecting TLS verification in Dancer::Plugin::Auth::Google and another involving random secret generation in GD::SecurityImage. No PoC, exploit, patch, or active exploitation details are given.
10000161
4.7K followersView on X

Explore more

Back to dashboard