Authorization Code Vulnerability in Google::Auth for Perl
CVE-2026-74760

Currently unrated

Key Information:

Status
Vendor
CVE Published:
1 November 2026

What is CVE-2026-74760?

The Google::Auth library for Perl, specifically versions 0.11 through 0.12, is susceptible to a vulnerability due to the improper handling of authorization codes from local processes. When using the gcloud-auth login callback, the library does not verify the state parameter associated with the OAuth request, allowing a local attacker to submit an authorization code for their own Google account. This flaw enables the attacker’s code to be exchanged for credentials, leading to unauthorized access to the user's tools and data, effectively allowing the attacker to impersonate the user.

References

https://metacpan.org/release/CJCOLLIER/Google-Auth-0.12/s...
technical-description

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.