CVE-2026-12746: Dancer2 OAuth 2.0 State Parameter Missing – Account Takeover Risk

Technical summary

The vulnerability stems from two defects in the OAuth 2.0 implementation: (1) the authentication_url method does not generate and include a state parameter when building the provider authorization URL, and (2) the callback method does not validate that an incoming authorization code matches a state value previously stored in the session. The OAuth 2.0 specification (RFC 6749) mandates the state parameter precisely to prevent CSRF attacks by creating a cryptographic binding between the authorization request and the callback. Without this binding, any callback code can be associated with any session, enabling an attacker to complete an authorization flow they initiated on behalf of a victim. This is particularly dangerous in applications that persist OAuth provider identity mappings to user accounts.

Business impact

Organizations using this plugin for OAuth 2.0 authentication face account takeover risk. An attacker can associate their own provider credentials with a victim's application account, granting themselves login access without knowing the victim's password. If multi-factor authentication relies solely on the application's internal login and does not re-verify OAuth provider identity at sensitive operations, the attacker gains full account access. In worst-case scenarios—particularly for applications managing sensitive data, financial transactions, or administrative functions—this could facilitate fraud, data theft, or privilege escalation. The attack requires only user interaction (clicking a malicious link), making it broadly exploitable.

Affected systems

Dancer2::Plugin::Auth::OAuth::Provider versions prior to 0.23 are vulnerable. This affects any Perl-based web application using this plugin for OAuth 2.0 authentication. Dancer2 is a lightweight Perl web framework; applications commonly include those built on microservices, API backends, or internal authentication systems in organizations with Perl infrastructure. The plugin is used to delegate authentication to external OAuth 2.0 providers (e.g., GitHub, Google, custom corporate identity servers).

Exploitability

Exploitability is high. The attack requires no special technical sophistication: an attacker initiates a legitimate OAuth flow with a provider under their control, obtains a callback code, and crafts a URL containing that code to send to a victim (e.g., via phishing or URL shortening). The victim's browser automatically includes session cookies, and the vulnerable plugin accepts the code without validation. No special network positioning, authentication, or privilege is needed. The CVSS score of 8.1 (HIGH) reflects the high impact (account hijacking) and low attack complexity. The attack is not currently tracked as actively exploited (KEV status: not listed), but the simplicity of the attack vector and the severity of consequences make rapid remediation critical.

Remediation

Upgrade Dancer2::Plugin::Auth::OAuth::Provider to version 0.23 or later. Version 0.23 implements RFC 6749 compliance by generating a cryptographic state parameter during authorization_url, storing it in the session, and validating it on callback before accepting the authorization code. Organizations should verify the upgrade against official vendor documentation and test OAuth login flows in a staging environment before production rollout. For applications that have already been running vulnerable versions, consider auditing recent login activity and account linking to detect potential unauthorized provider associations.

Patch guidance

Update the plugin to version 0.23 or later via standard Perl package management (CPAN, or your organization's internal package repository). Verify the upgrade by checking the plugin version reported in application logs or by running `perl -MVersion -e` against Dancer2::Plugin::Auth::OAuth::Provider. After patching, test the full OAuth 2.0 flow end-to-end with a test provider account to confirm state validation is working. Organizations with strictly locked dependencies should verify compatibility with their specific Dancer2 version, though version 0.23 is designed to be a drop-in replacement.

Detection guidance

Monitor application authentication logs for suspicious patterns: (1) authorization callbacks lacking corresponding session-initiated OAuth requests, (2) multiple OAuth callbacks completing within a short timeframe from different providers but to the same user account, (3) provider identity links being added to accounts that rarely use OAuth. If you maintain application logs, search for OAuth callback processing without matching session state entries. On the provider side (if you operate an internal OAuth server), look for authorization codes issued to one account but redeemed in callback requests that reference a different session or client state. A forensic review of account linking history can reveal unauthorized provider associations.

Why prioritize this

This vulnerability should be prioritized highly because: (1) account takeover is a critical business impact, (2) exploitation requires only a victim's interaction with a malicious link (low barrier), (3) patches are available and straightforward to deploy, (4) the attack is specific enough that legacy versions are clearly vulnerable but recent versions are patched. Organizations running this plugin should treat this as a P1 security issue and schedule updates within days rather than weeks.

Risk score, explained

CVSS 3.1 score of 8.1 (HIGH) is driven by: High confidentiality and integrity impact (C:H, I:H)—the attacker gains login access and can access all data and modify account settings visible to the user. Network attack vector (AV:N) and low complexity (AC:L) reflect easy exploitation via HTTP callback interception. User interaction required (UI:R) is the one limiting factor—the victim must click a link or be redirected to the callback, though this is a very reasonable precondition for web-based CSRF. The scope is unchanged (S:U), and no availability impact (A:N) as the service itself remains operational. The 8.1 score appropriately reflects a serious vulnerability requiring urgent attention.

Frequently asked questions