CVE-2026-74760

The record

Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state. The gcloud-auth login and application-default login commands send a state parameter with the authorization request, then take the code from the first request to reach their loopback listener without comparing the returned state. A local attacker can submit an authorization code for their own Google account. The CLI exchanges it and stores the refresh token as the user's credentials, so the user's tools then act as the attacker's account.

Affected packages

Related vulnerabilities

• CVE-2026-120987 Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a… CWE-346
• CVE-2026-105769 kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure… CWE-346
• CVE-2026-119331 Ladybird is a truly independent web browser. CWE-346
• CVE-2026-7005 WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request… CWE-346
• CVE-2026-119416 CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the… CWE-346
• CVE-2026-76026 Origin validation error in Autofill in Google Chrome prior to 156.0.8078.79 allowed a… CWE-346
• CVE-2026-119285 Fiber is an Express inspired web framework written in Go. CWE-346
• CVE-2026-61546 AnkiMCP is an Anki addon that implements an MCP server, enabling AI assistants to… CWE-346