{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/googleauth-0.11-0.12/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-74759"},{"id":"CVE-2026-74760"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Google::Auth (0.11-0.12)"],"_cs_severities":["medium"],"_cs_tags":["vulnerability","perl","oauth","ssrf"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eTwo vulnerabilities were disclosed in the Google::Auth Perl module. CVE-2026-74759 concerns an SSRF vulnerability occurring when the library processes unvalidated \u003ccode\u003ecredential_source\u003c/code\u003e URLs while handling AWS external account credentials. CVE-2026-74760 involves an authentication bypass in the \u003ccode\u003egcloud-auth\u003c/code\u003e login callback, which fails to verify OAuth state parameters, allowing an attacker to inject an authorization code from an unauthorized local process.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eCVE-2026-74759 may allow an attacker to force the application to make unauthorized requests to internal network resources. CVE-2026-74760 may lead to account takeover or unauthorized access to Google Cloud resources if an attacker successfully intercepts or injects a local authorization callback.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Google::Auth for Perl to a patched version that resolves these vulnerabilities.\u003c/li\u003e\n\u003cli\u003eAudit applications using Google::Auth to identify usage of AWS external account credentials or local \u003ccode\u003egcloud-auth\u003c/code\u003e login workflows.\u003c/li\u003e\n\u003cli\u003eRestrict local network access for applications performing OAuth flows to prevent unauthorized local process interference.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-01T18:56:21Z","date_published":"2026-11-01T18:56:21Z","id":"https://feed.craftedsignal.io/briefs/2026-11-google-auth-perl/","summary":"The Google::Auth Perl module is vulnerable to server-side request forgery (SSRF) via unvalidated AWS credential URLs (CVE-2026-74759) and an OAuth authorization bypass (CVE-2026-74760) due to missing state validation in the gcloud-auth login callback.","title":"Google::Auth for Perl: SSRF and OAuth state validation vulnerabilities (CVE-2026-74759, CVE-2026-74760)","url":"https://feed.craftedsignal.io/briefs/2026-11-google-auth-perl/"}],"language":"en","title":"CraftedSignal Threat Feed - Google::Auth (0.11-0.12)","version":"https://jsonfeed.org/version/1.1"}