CVE-2026-12740 describes a CSRF vulnerability in Plack::Middleware::OAuth versions <=0.10. The middleware fails to issue or verify the OAuth 2.0 state parameter during the authorization process. Specifically, RequestTokenV2 does not issue a state value in the provider authorization redirect, and AccessTokenV2 does not verify that the callback corresponds to the session that initiated the authorization. This flaw allows an attacker to initiate an OAuth authorization with their own provider account and then deliver the resulting callback to a victim's session, causing the victim's session to be linked to the attacker's OAuth credentials. Consequently, the attacker may gain persistent access to the victim's account if the application stores this association.

An attacker can perform login CSRF attacks by causing a victim's session to complete an OAuth authorization initiated by the attacker. This can lead to unauthorized account linking, allowing the attacker to access the victim's account through their own OAuth provider credentials. The confidentiality and integrity of the victim's account are compromised, but availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, applications using Plack::Middleware::OAuth for OAuth 2.0 login should implement their own verification of the OAuth 2.0 state parameter to bind authorization callbacks to the initiating session, preventing CSRF attacks. Avoid relying solely on the vulnerable middleware for OAuth 2.0 flows.