The Dancer2::Plugin::Auth::OAuth::Provider plugin fails to generate the OAuth 2.0 state parameter during the authorization redirect and does not bind the callback to the session that began the flow. This omission permits a login cross‑site request forgery (CSRF) attack where an attacker can cause a victim’s session to complete the attacker’s OAuth authorization, linking the attacker’s provider identity and access token to the victim’s session. The weakness is a classic example of CWE‑352.

Any application that incorporates BIAFRA's Dancer2::Plugin::Auth::OAuth::Provider version before 0.23 for Perl is vulnerable. Systems using this plugin for OAuth 2.0 login, especially those that persist external identities in user accounts, are at risk.

Based on the description, it is inferred that a remote attacker can manipulate a victim’s browser to follow the attacker’s authorization request and later deliver a crafted callback that binds the victim’s session to the attacker’s provider account. The CVSS score of 8.1 indicates a high severity level, while the EPSS score of < 1% shows a low probability of exploitation at this time. The vulnerability is listed as Login Cross‑Site Request Forgery (CWE‑352) and could lead to session hijacking or unauthorized account linkage. The lack of KEV listing suggests the vulnerability has not yet been observed in the wild.