CVE-2026-12740: Plack::Middleware::OAuth CSRF Vulnerability

CVE-2026-12740 Overview

CVE-2026-12740 is a login cross-site request forgery (CSRF) vulnerability in Plack::Middleware::OAuth versions through 0.10 for Perl. The middleware does not implement the OAuth 2.0 state parameter defined in RFC 6749 Section 10.12. RequestTokenV2 builds provider authorization redirects without generating a state value, and AccessTokenV2 processes callback codes without verifying the callback originated from the same session that initiated the flow. Any application that uses this middleware for OAuth 2.0 login is exposed to session identity confusion attacks [CWE-352].

Critical Impact
An attacker can bind their own provider identity to a victim's session, and where applications persist this link, retain persistent access to the victim's account through attacker-controlled provider credentials.

Affected Products

Plack::Middleware::OAuth for Perl, versions through 0.10
Any Perl application using this middleware for OAuth 2.0 login flows
Downstream CPAN-distributed applications embedding the vulnerable middleware

Discovery Timeline

2026-07-04 - CVE-2026-12740 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-12740

Vulnerability Analysis

The OAuth 2.0 specification defines the state parameter as the mechanism binding an authorization request to the user agent session that initiated it. Plack::Middleware::OAuth omits this binding entirely. RequestTokenV2 constructs the redirect to the identity provider without generating or storing a per-session state token. When the provider redirects the user back with an authorization code, AccessTokenV2 exchanges that code for an access token and calls register_session to associate the resulting provider identity with the current session, with no check that this session ever began an authorization flow.

This omission allows an attacker to initiate an OAuth flow under their own provider account, capture the callback URL containing the authorization code, and deliver it to a victim. When the victim's browser loads the callback, the victim's session completes the attacker's authorization. If the application uses OAuth for account linking, the attacker's provider account becomes a valid login credential for the victim's account.

Root Cause

The root cause is missing CSRF protection on the OAuth 2.0 authorization callback endpoint. RequestTokenV2 does not emit a state parameter, and AccessTokenV2 does not validate one. There is no session-bound nonce that ties the callback back to the browser that initiated the request, violating RFC 6749 Section 10.12.

Attack Vector

Exploitation requires network access to the target application and user interaction from the victim, typically through a crafted link or embedded resource pointing to the OAuth callback URL. The attacker begins an OAuth authorization on the target site using their own provider account, intercepts the callback URL containing the authorization code, and delivers that URL to the victim. When the victim visits the URL while authenticated, their session completes the attacker's flow, associating the attacker's provider identity and access token with the victim's account.

See the GitHub Pull Request and CPAN Ticket #179874 for the technical fix details.

Detection Methods for CVE-2026-12740

Indicators of Compromise

Callback requests to OAuth endpoints lacking a state query parameter or containing a state value not previously issued to the session.
Multiple successful OAuth callbacks resolving to the same provider identity across different application sessions or user accounts.
Account link records associating a single external provider identity with more than one internal user account.
Access log entries showing OAuth callbacks preceded by referrers from untrusted domains.

Detection Strategies

Inventory Perl web applications and scan CPAN manifests, cpanfile, and Makefile.PL files for Plack::Middleware::OAuth versions at or below 0.10.
Instrument the OAuth callback route to log requests missing a state parameter or presenting a state value not bound to the current session.
Audit account-link and identity-mapping tables for anomalous provider-to-user associations created after the middleware was deployed.

Monitoring Recommendations

Monitor authentication logs for OAuth callback completions that are not preceded by an in-session authorization initiation event.
Alert on new account-link events where the provider identity has recently been linked to another user in the same tenant.
Track referrer headers on OAuth callback endpoints and flag requests originating from external or unexpected domains.

How to Mitigate CVE-2026-12740

Immediate Actions Required

Upgrade Plack::Middleware::OAuth to a version containing the fix from CPAN Ticket #179874 or apply the Metacpan CVE-2026-12740 Patch directly.
Audit existing account-link records created since the middleware was deployed and require re-verification of provider linkages.
Invalidate active sessions and force reauthentication for accounts whose OAuth linkage cannot be attested.

Patch Information

A patch is available through the GitHub Pull Request and distributed as the Metacpan CVE-2026-12740 Patch. The fix introduces generation of a cryptographically random state parameter in RequestTokenV2, stores it in the session, and validates it in AccessTokenV2 before registering the returned token. Discussion of the fix is available in the Openwall OSS-Security Discussion.

Workarounds

Wrap Plack::Middleware::OAuth with a custom middleware layer that generates a state value, stores it in the session on authorization initiation, and validates it on the callback route before invoking register_session.
Disable OAuth 2.0 login flows served by this middleware until the patch is applied.
Require an additional authentication factor before persisting new OAuth account links to reduce the impact of a forged callback.

bash

# Upgrade the middleware via cpanm once a fixed release is available
cpanm --reinstall Plack::Middleware::OAuth

# Or apply the vendor patch directly against an installed 0.10 tree
curl -O https://security.metacpan.org/patches/P/Plack-Middleware-OAuth/0.10/CVE-2026-12740-r1.patch
patch -p1 -d /path/to/Plack-Middleware-OAuth-0.10 < CVE-2026-12740-r1.patch