Google::Auth for Perl versions earlier than 0.09 can expose credentials and facilitate server-side request forgery because the library accepts URL values directly from the credentials JSON and sends network requests to those hosts without validation. An attacker who can influence the credentials configuration may force the application to reach internal or external services, and the requests carry sensitive tokens or secrets that the application holds. This flaw allows credential exfiltration and can compromise the confidentiality of service account keys, user secrets, or other privileged data.

Systems that use the Perl package CJCOLLIER::Google::Auth with a version before 0.09 are vulnerable. The issue was addressed in version 0.09, which validates each request host against the standard googleapis.com domain or a universe domain that the application pins. Administrators should review any deployment that imports credentials JSON into the library, particularly in environments using external_account, authorized_user, impersonated_service_account, or service_account configurations.

The vulnerability has no publicly reported exploit, but it is a high-risk server-side request forgery that can lead to data theft or unauthorized service calls. With an EPSS score not available and the vulnerability not listed in CISA KEV catalog, the exact likelihood of exploitation remains unknown, yet the severity is high due to the potential for credential leakage. An attacker with control over the credentials JSON can execute arbitrary network requests from the application’s network position, including accessing internal metadata endpoints and exfiltrating credentials that are automatically attached to outgoing HTTP requests by the library.