/ 
Dancer-Plugin-Auth-Google-0.07
⭐ Starred 0
Security Advisories (1)
CVE-2026-13410 (2026-07-17)

Dancer::Plugin::Auth::Google versions through 0.07 for Perl have TLS verification disabled. The default user agent is initialised with SSL_verify_mode explicitly disabled. An attacker with network man-in-the-middle (MITM) capability between the Dancer application and googleapis.com can intercept the OAuth2 token exchange and userinfo fetch, return a forged access_token and user profile, and be logged in to the Dancer application as any Google user.

Changes for version 0.07 - 2019-02-28

  • updated endpoints to OAuth via Google Identity Platform.
  • remove calls to deprecated G+ endpoints.
  • include "legacy_gplus" option to keep old data structure on session('google_user').
  • updated documentation to reflect changes.
  • include documentation on how to pass 'state' data around.

Documentation

README.md

Modules

Dancer::Plugin::Auth::Google
Authenticate with Google

Other files