Google::Auth version 0.12 for Perl contains a server-side request forgery (SSRF) vulnerability due to unvalidated URLs in AWS external account credentials. The vulnerability arises because the credential_source URLs used by the AWS external account credentials are not properly host-checked, allowing crafted configurations to cause requests to arbitrary hosts, including internal services and metadata endpoints.