CVE-2026-12746 BIAFRA CVE debrief

Who should care

Developers and administrators of applications using Dancer2::Plugin::Auth::OAuth::Provider for OAuth 2.0 login should be aware of this vulnerability and take steps to mitigate it. This includes updating to version 0.23 or later of the plugin and implementing additional security measures to prevent CSRF attacks.

Technical summary

The authentication_url method in Dancer2::Plugin::Auth::OAuth::Provider builds the provider authorization redirect without issuing a state value. The callback method exchanges the callback code and registers the resulting token into the session without verifying that the callback corresponds to an authorization request this session initiated. This allows an attacker to perform a CSRF attack by delivering the callback to a victim, causing the victim's session to complete the attacker's authorization.

Defensive priority

High priority should be given to updating to version 0.23 or later of Dancer2::Plugin::Auth::OAuth::Provider. Additionally, applications should implement CSRF protection mechanisms, such as token-based validation, to prevent attacks.

Recommended defensive actions

• Update to version 0.23 or later of Dancer2::Plugin::Auth::OAuth::Provider
• Implement CSRF protection mechanisms, such as token-based validation
• Verify that the callback corresponds to an authorization request this session initiated
• Use a secure token to prevent CSRF attacks
• Monitor for suspicious activity and implement incident response plans

Evidence notes

The CVE record and NVD detail provide information on the vulnerability, including its description, CVSS score, and references. The source item URL provides additional information on the vulnerability, including its status and references.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.