The vulnerability arises from the Dancer::Plugin::Auth::Google library disabling TLS verification by default, allowing an attacker who can position a man‑in‑the‑middle between the application and Google’s API endpoints to intercept the OAuth2 token exchange and userinfo retrieval. By returning a forged access token and user profile, the attacker can log in to the Dancer application as any Google user. This constitutes an account takeover with potential to access sensitive data within the application. The weakness is identified as CWE‑295, Threat: Impersonation.

Affected software is GARU’s Dancer::Plugin::Auth::Google, version 0.07 and older. These releases initialize the default HTTP user agent with SSL_verify_mode disabled, enabling insecure connections to googleapis.com.

The vulnerability carries a CVSS score of 8.2 and an EPSS score of less than 1 %, indicating theoretically low but non‑zero exploitation likelihood. It is not yet in the CISA KEV catalog. Exploitation requires the attacker to have network control to perform MITM; no additional privileges are required. Given the high impact of account takeover and the presence of a published patch, the risk remains significant for installations that have not yet upgraded.