Google::Auth for Perl flaws raise SSRF and OAuth risks
The oss-sec advisory, published on November 1, 2026, describes two flaws in Google::Auth for Perl: SSRF in version 0.12 and improper OAuth code acceptance in versions 0.11 through 0.12.
By Wendelmaques Pereira · Updated today
Source: Google::Auth para Perl (2 CVEs) (seclists.org). Text prepared with AI from this source.
What happened and what to do
The oss-sec advisory, published on November 1, 2026, reports two flaws in Google::Auth for Perl. CVE-2026-74759 enables SSRF in version 0.12 through unvalidated `credential_source` URLs in AWS external account credentials. CVE-2026-74760 affects versions 0.11 through 0.12: the `gcloud-auth` login callback accepts an authorization code from any local process because it does not check the OAuth state.
A company using these versions can inventory affected dependencies and services, update or replace the library, and review external account credentials and login flows. It can also implement source URL checks, OAuth state validation, and monitoring for attempts to access internal resources, with tests to confirm the controls.
How the consultancy can help
Wendelmaques can diagnose exposure in dependencies and authentication flows, define a remediation scope, and implement updates, validation, and monitoring. Ongoing operation can be included in the agreed scope.
Next step
Send a brief description of the versions and authentication flows your company uses to receive a scoped proposal.
Let's assess your project
I reply with scope and a proposal.