Plack::Middleware::OAuth versions up through 0.10 omit support for the OAuth 2.0 state parameter, and the RequestTokenV2 routine builds the provider authorization redirect AccessTokenV2 routine accepts the callback code and registers the resulting token into the session (register_session) without verifying that the callback originates from an authorization request that this session initiated. This flaw, which is a Cross‑Site Request Forgery (CWE‑352) weakness, allows an attacker to perform login cross‑site request forgery. If an application uses this middleware for OAuth 2.0 authentication, the attacker can start an authorization flow with a malicious provider account and deliver the callback to a victim’s browser, causing the victim’s session to complete the attacker’s authorization and associate the victim’s session with the attacker’s provider identity and access token. When the application persists that link, the attacker may retain long‑term access to the victim’s account using their own provider credentials.

The vulnerability impacts the Perl module Plack::Middleware::OAuth, developed by CORNELIUS, specifically versions through 0.10. Perl applications that incorporate this module for OAuth 2.0 authentication are susceptible if they use those versions.

The EPSS score is < 1%, indicating a very low exploitation probability. The CVSS score of 8.1 reflects a high risk to confidentiality, integrity, and availability. The flaw permits any authenticated OAuth flow without state validation, resulting in a high‑impact login cross‑site request forgery. The flaw is not listed in the CISA KEV catalog and there is no known public exploitation. The likely attack vector is an attacker initiating an OAuth authorization with a malicious provider account and then delivering the callback to a victim’s browser, thereby hijacking the victim’s session. While the vulnerability does not allow remote code execution, it enables an attacker to gain persistent access to a user’s linked account through the victim’s session.