Google::Auth for Perl: SSRF and OAuth state validation vulnerabilities (CVE-2026-74759, CVE-2026-74760)

Two vulnerabilities were disclosed in the Google::Auth Perl module. CVE-2026-74759 concerns an SSRF vulnerability occurring when the library processes unvalidated credential_source URLs while handling AWS external account credentials. CVE-2026-74760 involves an authentication bypass in the gcloud-auth login callback, which fails to verify OAuth state parameters, allowing an attacker to inject an authorization code from an unauthorized local process.

Impact

CVE-2026-74759 may allow an attacker to force the application to make unauthorized requests to internal network resources. CVE-2026-74760 may lead to account takeover or unauthorized access to Google Cloud resources if an attacker successfully intercepts or injects a local authorization callback.

Recommendation

• Update Google::Auth for Perl to a patched version that resolves these vulnerabilities.
• Audit applications using Google::Auth to identify usage of AWS external account credentials or local gcloud-auth login workflows.
• Restrict local network access for applications performing OAuth flows to prevent unauthorized local process interference.