Server Side Request Forgery in Google::Auth for Perl
CVE-2026-66901

Currently unrated

Key Information:

Vendor: Cjcollier
Status: Google::auth
Vendor: CVE Published:; 4 August 2026

What is CVE-2026-66901?

The Google::Auth library for Perl prior to version 0.09 is susceptible to server-side request forgery, which enables potential credential exfiltration. This vulnerability arises from insufficient validation of URLs sourced from the credentials JSON, allowing crafted URLs to be processed without appropriate domain checks. As a consequence, unauthorized requests can traverse the application’s network based on potentially untrusted configurations. Versions 0.06 through 0.08 introduced various mitigations, but full protection against this vulnerability was only achieved in version 0.09.