The vulnerability in Plack::Middleware::OAuth (<=0.10) arises because the middleware does not support the OAuth 2.0 state parameter, which is critical for binding authorization requests to user sessions. The RequestTokenV2 function builds the authorization redirect without issuing a state value, and AccessTokenV2 registers the token into the session without verifying that the callback corresponds to the session that initiated the authorization. This enables login CSRF attacks where an attacker can cause a victim's session to complete the attacker's OAuth authorization, associating the victim's session with the attacker's credentials.

An attacker can exploit this vulnerability to link their own OAuth provider identity and access token to a victim's session. If the application persists this link as an account association, the attacker may gain unauthorized access to the victim's account through their own provider credentials. This compromises the integrity of user sessions and authentication flows relying on this middleware.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, applications using Plack::Middleware::OAuth for OAuth 2.0 login should implement their own verification of the OAuth 2.0 state parameter to bind authorization requests to user sessions and prevent login CSRF attacks.