Google::Auth (0.11-0.12) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/googleauth-0.11-0.12/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 01 Nov 2026 18:56:21 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgGoogle::Auth for Perl: SSRF and OAuth state validation vulnerabilities (CVE-2026-74759, CVE-2026-74760)https://feed.craftedsignal.io/briefs/2026-11-google-auth-perl/Sun, 01 Nov 2026 18:56:21 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-google-auth-perl/The Google::Auth Perl module is vulnerable to server-side request forgery (SSRF) via unvalidated AWS credential URLs (CVE-2026-74759) and an OAuth authorization bypass (CVE-2026-74760) due to missing state validation in the gcloud-auth login callback.Two vulnerabilities were disclosed in the Google::Auth Perl module. CVE-2026-74759 concerns an SSRF vulnerability occurring when the library processes unvalidated credential_source URLs while handling AWS external account credentials. CVE-2026-74760 involves an authentication bypass in the gcloud-auth login callback, which fails to verify OAuth state parameters, allowing an attacker to inject an authorization code from an unauthorized local process.

Impact

CVE-2026-74759 may allow an attacker to force the application to make unauthorized requests to internal network resources. CVE-2026-74760 may lead to account takeover or unauthorized access to Google Cloud resources if an attacker successfully intercepts or injects a local authorization callback.

Recommendation

  • Update Google::Auth for Perl to a patched version that resolves these vulnerabilities.
  • Audit applications using Google::Auth to identify usage of AWS external account credentials or local gcloud-auth login workflows.
  • Restrict local network access for applications performing OAuth flows to prevent unauthorized local process interference.
]]>mediumadvisoryvulnerabilityperloauthssrf