{"id":"CVE-2026-74760","kind":"vulnerability","aliases":["CVE-2026-74760"],"related":[],"title":"Google::Auth for Perl: login callback accepts any local authorization code","description":"Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state.\n\nThe gcloud-auth login and application-default login commands send a state parameter with the authorization request, then take the code from the first request to reach their loopback listener without comparing the returned state.\n\nA local attacker can submit an authorization code for their own Google account. The CLI exchanges it and stores the refresh token as the user's credentials, so the user's tools then act as the attacker's account.","summary":"Google::Auth versions 0.11 through 0.12 for Perl do not check the OAuth state value on the gcloud login callback. A local process can submit its own Google authorization code, so the stored credentials end up belonging to the attacker's account.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["developer-workstations","gcloud","google-cloud","package","perl"],"not_affected_if":["no-gcloud-login","not-perl","single-user-machine"],"how_to_check":"- Check the installed Google::Auth version with `perl -MGoogle::Auth -e 'print $Google::Auth::VERSION'`\n- Look for gcloud-auth or application-default login flows run on shared or multi-user machines\n- Search lockfiles and cpanfiles for `Google::Auth` pinned to 0.11 or 0.12","fix":"- Google::Auth versions 0.11 through 0.12 are affected; the sources do not name a fixed version","status":"open","published_at":"2026-11-01T17:16:34+00:00","first_seen_at":"2026-11-01T17:21:03+00:00","triaged_at":"2026-11-01T17:22:58+00:00","updated_at":"2026-11-01T17:22:58+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-01T17:22:58Z","model":"claude-haiku-5-5","output":{"fix":"- Google::Auth versions 0.11 through 0.12 are affected; the sources do not name a fixed version","reach":"local","title":"Google::Auth for Perl: login callback accepts any local authorization code","impact":"medium","summary":"Google::Auth versions 0.11 through 0.12 for Perl do not check the OAuth state value on the gcloud login callback. A local process can submit its own Google authorization code, so the stored credentials end up belonging to the attacker's account.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","google-cloud","gcloud","developer-workstations"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Local attacker's Google account credentials replace the user's stored login","analyst_note":"Sources do not name a fixed version or a patch; check the upstream Google::Auth changelog and the NVD entry for a fixed release.","how_to_check":"- Check the installed Google::Auth version with `perl -MGoogle::Auth -e 'print $Google::Auth::VERSION'`\n- Look for gcloud-auth or application-default login flows run on shared or multi-user machines\n- Search lockfiles and cpanfiles for `Google::Auth` pinned to 0.11 or 0.12","plain_action":"","needs_analyst":true,"not_affected_if":["not-perl","single-user-machine","no-gcloud-login"],"who_is_affected":"Teams that use the Perl Google::Auth library and run the gcloud-auth or application-default login flow on a machine where other local users or processes could run code. The flaw is local: an attacker must already be able to run a process on the same machine during the login window. Systems that do not use the Perl library or the gcloud login flow on shared hosts can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000744,"input_tokens":4192,"output_tokens":650,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-74760':14A,17A '0.11':30B,73C '0.12':32B,75C 'accept':7A,78C 'account':68B,148C,174C 'act':169C 'applic':106C 'application-default':105C 'attack':66B,138C,172C 'auth':2A,28B,70C,90C,102C 'author':10A,55B,80C,116C,142C 'belong':63B 'callback':6A,46B,92C 'check':37B,95C 'cli':150C 'cloud':24B 'code':11A,56B,81C,121C,143C 'command':109C 'compar':132C 'credenti':60B,162C 'cve':12A,15A 'default':107C 'develop':19B 'developer-workst':18B 'end':61B 'exchang':151C 'first':124C 'gcloud':21B,44B,89C,101C 'gcloud-auth':88C,100C 'googl':1A,23B,27B,54B,69C,147C 'google-cloud':22B 'listen':130C 'local':9A,48B,84C,137C 'login':5A,45B,91C,103C,108C 'loopback':129C 'oauth':39B,97C 'packag':25B 'paramet':113C 'perl':4A,26B,34B,77C 'process':49B,85C 'reach':127C 'refresh':156C 'request':117C,125C 'return':134C 'send':110C 'state':40B,98C,112C,135C 'store':59B,154C 'submit':51B,140C 'take':119C 'token':157C 'tool':167C 'user':160C,165C 'valu':41B 'version':29B,71C 'without':131C 'workstat':20B","nicknames":[],"mitigations":[],"who_affected":"Teams that use the Perl Google::Auth library and run the gcloud-auth or application-default login flow on a machine where other local users or processes could run code. The flaw is local: an attacker must already be able to run a process on the same machine during the login window. Systems that do not use the Perl library or the gcloud login flow on shared hosts can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"first_public_at":"2026-11-01T17:16:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-74760","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74760","severity":null,"published_at":"2026-11-01T17:16:34+00:00","modified_at":"2026-11-01T17:16:34+00:00","first_seen_at":"2026-11-01T17:21:03+00:00","fetched_at":"2026-11-01T17:21:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}