Google::Auth for Perl versions earlier than 0.09 can expose credentials and facilitate server‑side request forgery because the library accepts URL values directly from the credentials JSON and sends network requests to those hosts without validation. An attacker who can influence the credentials configuration may force the application to reach internal or external services, and the requests carry sensitive tokens or secrets that the application holds. This flaw allows credential exfiltration and can compromise the confidentiality of service account keys, user secrets, or other privileged data.

Systems that use the Perl package CJCOLLIER::Google::Auth with a version before 0.09 are vulnerable. The issue was addressed in version 0.09, which validates each request host against the standard googleapis.com domain or a universe domain that the application pins. Administrators should review any deployment that imports credentials JSON into the library, particularly in environments using external_account, authorized_user, impersonated_service_account, or service_account configurations.

The vulnerability, with a CVSS score of 7.5, is a high‑risk server‑side request forgery that could lead to data theft or unauthorized service calls. The EPSS score is reported as < 1%, and the flaw is not listed in the CISA KEV catalog, so its current exploitation likelihood remains uncertain; however, the potential for credential leakage is significant. An attacker who can influence the credentials JSON can cause the application to issue arbitrary outbound requests from its own network position, potentially reaching internal metadata endpoints and exfiltrating credentials that the library automatically attaches to each HTTP request.