Threats affecting pkg:cpan/Google-Auth

Google::Auth versions 0.11 through 0.12 for Perl contain an origin validation error where the OAuth state parameter is not verified during the gcloud-auth login callback. This allows a local attacker to submit an authorization code for their own Google account, causing the CLI to store the attacker's refresh token as the user's credentials. Consequently, the user's tools operate under the attacker's account.

Google::Auth version 0.12 for Perl contains a server-side request forgery (SSRF) vulnerability due to unvalidated URLs in AWS external account credentials. This flaw allows attackers to make unauthorized HTTP GET and PUT requests to arbitrary hosts specified in the credential configuration, including internal and link-local metadata endpoints.