{"id":12902,"date":"2026-09-04T18:59:44","date_gmt":"2026-09-04T10:59:44","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-12740"},"modified":"2026-09-04T18:59:44","modified_gmt":"2026-09-04T10:59:44","slug":"cve-2026-12740","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-12740","title":{"rendered":"CVE-2026-12740 [HIGH] &#8211; Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state"},"content":{"rendered":"<p>Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter.<\/p>\n<p>RequestTokenV2 builds the provider authorization redirect without issuing a state value, and AccessTokenV2 exchanges the callback code and registers the resulting token into the session (register_session) without verifying that the callback corresponds to an authorization request this session initiated.<\/p>\n<p>Any application that uses this middleware for OAuth 2.0 login is exposed to login cross-site request forgery: because the callback is not bound to the session that began the flow, an attacker who starts an authorization with their own provider account can deliver the resulting callback to a victim, causing the victim&#8217;s session to complete the attacker&#8217;s authorization and associating the attacker&#8217;s provider identity and access token with that session. Where the application persists this as an account link, the attacker may retain access to the victim&#8217;s account through their own provider credentials.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter.<\/p>\n<p>RequestTokenV2 builds the provider authorization redirect without issuing a state value, and Acce<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-12902","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/12902","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12902"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12902"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12902"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}