The vulnerability in Dancer2::Plugin::Auth::OAuth::Provider (versions <0.23) arises from the lack of support for the OAuth 2.0 state parameter, which is designed to prevent CSRF attacks during OAuth login flows. Specifically, the authentication_url method does not generate a state value, and the callback method does not verify that the callback matches the session that initiated the OAuth authorization. This flaw enables an attacker to initiate an OAuth authorization with their own provider account and then deliver the resulting callback to a victim's session, causing the victim's session to be linked with the attacker's OAuth credentials. If the application persists this association as an account link, the attacker may gain persistent access to the victim's account via their own provider credentials.

Successful exploitation allows an attacker to perform login CSRF, causing a victim's session to be linked to the attacker's OAuth provider identity and access token. This can lead to unauthorized access to the victim's account if the application uses this plugin for OAuth 2.0 login and persists the account linkage. The vulnerability has a high severity with a CVSS score of 8.1, indicating a significant risk of confidentiality and integrity compromise without impacting availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, applications using this plugin should consider implementing their own verification of the OAuth 2.0 state parameter to bind authorization requests to user sessions. Avoid relying solely on this plugin for OAuth 2.0 login flows without additional CSRF protections.