CVE-2026-13410 describes a vulnerability in Dancer::Plugin::Auth::Google versions <=0.07 where TLS verification is explicitly disabled in the default user agent. This improper certificate validation (CWE-295) allows an attacker positioned as a man-in-the-middle between the Dancer application and googleapis.com to intercept OAuth2 token exchanges and userinfo fetches. The attacker can return forged access tokens and user profiles, resulting in unauthorized authentication as arbitrary Google users.

An attacker with network man-in-the-middle capability can impersonate any Google user to the vulnerable Dancer application by forging OAuth2 tokens and user profiles. This leads to a complete compromise of authentication, allowing unauthorized access with high confidentiality and integrity impact, and a low availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using affected versions or implement external TLS verification to ensure certificate validation is enforced.