Google::Auth versions prior to 0.09 for Perl allow SSRF and credential exfiltration due to unvalidated URLs in the credentials JSON. The library requests URLs specified in the credentials without verifying that their hosts belong to an expected universe domain. This affects external_account, authorized_user, impersonated_service_account, and service_account configurations, which use these URLs to fetch tokens and credentials. The vulnerability allows an attacker controlling the credentials configuration to induce requests from the application's network context to arbitrary hosts, including internal services and metadata endpoints. Starting with version 0.06, a _validate_url host check was introduced, and by version 0.09, comprehensive URL validation was added to all relevant credential classes.

An attacker who can supply or manipulate the credentials JSON can cause the application to make unauthorized network requests to arbitrary hosts, potentially accessing internal services or metadata endpoints. This can lead to credential exfiltration. The vulnerability does not allow replay of service_account assertions against Google due to audience binding. The CVSS score of 7.5 reflects a high severity with network attack vector, low complexity, no privileges required, no user interaction, and high confidentiality impact.

Upgrade Google::Auth for Perl to version 0.09 or later, where URL validation and host checks have been implemented to prevent SSRF. Versions 0.06 through 0.08 introduced partial mitigations, but only 0.09 fully addresses the issue across all credential classes. No official patch advisory was provided in the input, so verify with the vendor for the latest remediation guidance.