CVE-2026-13410 GARU CVE debrief

Who should care

Users of Dancer::Plugin::Auth::Google versions through 0.07 for Perl should be aware of the potential for man-in-the-middle attacks due to disabled TLS verification. This affects operators who manage Dancer applications, platform administrators responsible for security configurations, vulnerability management teams, and security teams monitoring for potential threats. They should review system configurations, assess potential impact, and plan for updates or mitigations.

Technical summary

The Dancer::Plugin::Auth::Google module for Perl has a security issue due to TLS verification being disabled by default. This is achieved by explicitly disabling SSL_verify_mode in the default user agent initialization. An attacker with network man-in-the-middle capability between the Dancer application and googleapis.com can intercept the OAuth2 token exchange and userinfo fetch. They can return a forged access_token and user profile, allowing them to be logged in to the Dancer application as any Google user. This issue requires immediate attention to prevent potential security breaches.

Defensive priority

High priority should be given to updating Dancer::Plugin::Auth::Google to a version that enables TLS verification. Implementing proper TLS verification for user agent initialization and monitoring for potential man-in-the-middle attacks are also crucial. Reviewing and updating network security configurations will help prevent similar vulnerabilities in the future.

Recommended defensive actions

• Update Dancer::Plugin::Auth::Google to a version that enables TLS verification.
• Implement proper TLS verification for user agent initialization.
• Monitor for potential man-in-the-middle attacks.
• Review and update network security configurations.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD detail provide information on the vulnerability. Additional details can be found in the source references, including a GitHub pull request and Metacpan documentation. Evidence limits suggest that further verification is needed to confirm affected deployments and assess potential impact. Defenders should verify system configurations, review network security settings, and monitor for potential man-in-the-middle attacks.

Official resources