CVE-2026-74760 CJCOLLIER CVE debrief

Who should care

Users of Google::Auth versions 0.11 through 0.12 for Perl, especially those using gcloud-auth login and application-default login commands, should assess their exposure and take necessary actions to prevent unauthorized access.

Why it matters

CVE-2026-74760 allows local attackers to submit authorization codes for their own Google accounts, potentially leading to unauthorized access. Users of Google::Auth versions 0.11 through 0.12 for Perl should assess their exposure and take necessary actions to prevent unauthorized access. The vulnerability requires verification of authorization code integrity and validation to prevent exploitation. Remediation priority is high for users of affected versions.

• Local attackers may submit authorization codes for their own Google accounts, potentially leading to unauthorized access.
• Users of affected Google::Auth versions may be vulnerable to unauthorized access.
• Verification of authorization code integrity and validation is necessary to prevent exploitation.
• Remediation priority is high for users of affected versions.

Technical summary

Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state. A local attacker can submit an authorization code for their own Google account, potentially leading to unauthorized access. The vulnerability affects the gcloud-auth login and application-default login commands, requiring verification of authorization code integrity and validation to prevent exploitation. Remediation priority is high for users of affected versions.

Defensive priority

High priority for users of Google::Auth versions 0.11 through 0.12 for Perl, especially those using gcloud-auth login and application-default login commands.

Recommended defensive actions

• Review and update Google::Auth versions to ensure the latest security patches are applied.
• Implement additional security measures, such as monitoring and authentication checks, to prevent unauthorized access.
• Verify the integrity of authorization codes and ensure they are properly validated.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. The Metacpan reference provides additional context about the affected Google::Auth versions. Further verification is needed to confirm affected product deployments and assess exposure. The vulnerability requires verification of authorization code integrity and validation to prevent exploitation. Remediation priority is high for users of affected versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.