PatchSiren

BIAFRA CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

Review BIAFRA CVE published 2026-07-04

CVE-2026-12746

CVE-2026-12746 is a vulnerability in Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl. The plugin does not support the OAuth 2.0 state parameter, which allows an attacker to perform a login cross-site request forgery (CSRF) attack. An attacker can start an authorization with their own provider account and deliver the resulting callback to a victim, causing the victim's session to compl [truncated]

CRITICAL BIAFRA CVE published 2026-06-15

CVE-2026-11832

CVE-2026-11832 is a vulnerability in Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl. The plugin defaults to a predictable nonce generated using an MD5 hash of the epoch time.