========================================================================
CVE-2026-74760                                       CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-74760

   Distribution:  Google-Auth
       Versions:  from 0.11 through 0.12
       MetaCPAN:  https://metacpan.org/dist/Google-Auth
       VCS Repo:
https://github.com/GoogleCloudPlatform/google-auth-library-perl

Google::Auth versions from 0.11 through 0.12 for Perl accept an
authorization code from any local process because the gcloud-auth login
callback does not check the OAuth state

Description
-----------
Google::Auth versions from 0.11 through 0.12 for Perl accept an
authorization code from any local process because the gcloud-auth login
callback does not check the OAuth state.

The gcloud-auth login and application-default login commands send a
state parameter with the authorization request, then take the code from
the first request to reach their loopback listener without comparing
the returned state.

A local attacker can submit an authorization code for their own Google
account. The CLI exchanges it and stores the refresh token as the
user's credentials, so the user's tools then act as the attacker's
account.

Problem types
-------------
- CWE-346 Origin Validation Error

Workarounds
-----------
Run gcloud-auth login and gcloud-auth application-default login with
--no-browser, which uses the out-of-band flow without a loopback
listener.

Solutions
---------
Upgrade to a future Google-Auth release.

References
----------
https://metacpan.org/release/CJCOLLIER/Google-Auth-0.12/source/bin/gcloud-auth.pl