CVE-2026-12746: Dancer2 OAuth Plugin CSRF Vulnerability

CVE-2026-12746 Overview

CVE-2026-12746 is a login Cross-Site Request Forgery (CSRF) vulnerability in Dancer2::Plugin::Auth::OAuth::Provider for Perl, affecting versions before 0.23. The plugin does not implement the OAuth 2.0 state parameter defined in RFC 6749 §10.12. The authentication_url method builds authorization redirects without a state value, and the callback method exchanges the returned code and stores the resulting token in the session without verifying that the callback matches an authorization request the session initiated. Any Dancer2 application relying on this plugin for OAuth 2.0 login is exposed to session-level identity binding attacks. The weakness is classified under [CWE-352].

Critical Impact
An attacker can trick a victim's session into completing the attacker's OAuth authorization, binding the attacker's provider identity and access token to the victim's account and enabling persistent account takeover.

Affected Products

Dancer2::Plugin::Auth::OAuth::Provider for Perl, versions before 0.23
Dancer2 web applications using this plugin for OAuth 2.0 login flows
Applications that persist OAuth callbacks as account links to existing user accounts

Discovery Timeline

2026-07-04 - CVE-2026-12746 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-12746

Vulnerability Analysis

The plugin implements the OAuth 2.0 authorization code flow but omits the state parameter that binds an authorization request to the initiating browser session. Without this binding, the callback handler treats any arriving authorization code as valid for the current session. An attacker initiates OAuth with their own provider account, captures the resulting callback URL, and delivers it to a victim through a link, redirect, or embedded resource. When the victim's browser hits the callback, the plugin exchanges the code for a token and stores the attacker's provider identity in the victim's session.

Root Cause

The root cause is the absence of anti-CSRF protection in the OAuth 2.0 flow. The authentication_url method generates the provider redirect without a random, session-bound state value. The callback method accepts the returned code and completes the token exchange without validating that the callback corresponds to an authorization request this session started. This violates RFC 6749 §10.12, which requires the state parameter to defend against cross-site request forgery on the redirection endpoint.

Attack Vector

Exploitation requires user interaction: the victim must load the attacker-supplied callback URL while an active session exists. Where the target application persists the OAuth binding as an account link, the attacker retains long-term access to the victim's account through their own provider credentials. The attack requires no privileges on the target application and works across the network.

text

# Patch excerpt: Changes file entry documenting the fix in version 0.23
 {{$NEXT}}
 
+        - Generate state on OAuth2 as CSRF defense (RFC 6749 §10.12) CVE-2026-12746
+
 0.22  2026-06-10 14:39:03 WEST
 
         - Generate nonce from a secure source of randomness - CVE-2026-11832

Source: GitHub OAuth Patch Commit

Detection Methods for CVE-2026-12746

Indicators of Compromise

OAuth callback requests to /auth/*/callback endpoints lacking a state query parameter or arriving without a matching prior authorization initiation from the same session.
Session records where the OAuth provider identity or email domain does not match the authenticated user's expected identity.
Unexpected account link additions in application databases where the linked provider account belongs to a different party than the account owner.

Detection Strategies

Inspect application logs for OAuth callback processing that occurred without a preceding authentication_url call within the same session identifier.
Correlate provider sub or account identifiers stored in sessions against historical values to flag identity changes on active accounts.
Alert on referrer or origin mismatches on OAuth callback endpoints where the initiating page did not originate from the application.

Monitoring Recommendations

Enable verbose logging around authentication_url and callback execution paths to record request correlation identifiers.
Monitor CPAN dependency manifests (cpanfile, META.json) across deployments for Dancer2::Plugin::Auth::OAuth versions below 0.23.
Track successful account-link operations and require re-authentication when a new provider identity is bound to an existing account.

How to Mitigate CVE-2026-12746

Immediate Actions Required

Upgrade Dancer2::Plugin::Auth::OAuth to version 0.23 or later from CPAN across all Dancer2 deployments.
Audit existing account-link records created before the patch and revoke provider bindings that cannot be verified against the account owner.
Invalidate active sessions and stored access tokens created through the vulnerable flow to eliminate persistent attacker access.

Patch Information

The fix is delivered in Dancer2-Plugin-Auth-OAuth 0.23, released 2026. The patch generates a cryptographically random state value during authentication_url and validates it during callback, aligning the plugin with RFC 6749 §10.12. Review the MetaCPAN OAuth Plugin Diff and the GitHub OAuth Patch Commit for the code changes.

Workarounds

If immediate upgrade is not possible, wrap the OAuth flow with application-level middleware that generates a session-bound state parameter and rejects callbacks without a matching value.
Require re-authentication with existing credentials before binding a new OAuth provider identity to an established account.
Restrict OAuth callback endpoints to authenticated sessions and enforce strict Referer or Origin header validation as a defense-in-depth control.

bash

# Upgrade the vulnerable Perl module using cpanm
cpanm Dancer2::Plugin::Auth::OAuth@0.23

# Verify the installed version
perl -MDancer2::Plugin::Auth::OAuth -e 'print $Dancer2::Plugin::Auth::OAuth::VERSION, "\n"'