Cyber ·
Two vulnerabilities reported in Google::Auth for Perl
An advisory published on November 1, 2026 describes two flaws in Google::Auth for Perl: SSRF through unvalidated URLs and acceptance of OAuth authorization codes without state verification.
An oss-sec feed advisory, published on November 1, 2026, reports two vulnerabilities in Google::Auth for Perl. CVE-2026-74759 affects version 0.12 and enables server-side request forgery (SSRF) through unvalidated credential_source URLs in external AWS account credentials. CVE-2026-74760 affects versions 0.11 through 0.12: the gcloud-auth login callback accepts an OAuth authorization code from any local process because it does not verify the state parameter.
Consult the original advisory in the oss-sec feed and check the CVE identifiers, affected versions, and technical details before deciding on any action. If you use AI to analyze or apply the material, do not submit credentials, authorization codes, personal data, or internal configurations; verify conclusions against the advisory and relevant technical documentation.