CVE-2026-19349

This is a Perl signature collision vulnerability, not a simple typo. The root cause is that `getApacheSession()` accepts trailing positional arguments as implicit hash key-value pairs, and the codebase provides no schema enforcement to catch the mismatch. When a developer calls `getApacheSession( undef, 1, 0, 'GitHubState' )` instead of `getApacheSession( undef, kind => 'GitHubState' )`, Perl interprets the trailing arguments as hash pairs: `{'1' => 0, 'GitHubState' => undef}`. The function looks for a named parameter `kind` but finds only the implicit hash keys `1` and `GitHubState`, so it falls back to the default session type (SSO). The state identifier intended for CSRF validation is then stored in a session accessible to an unauthenticated caller — creating a replay token that can be used to hijack the OAuth2 flow. This pattern is endemic to legacy Perl APIs using the trailing-hash idiom. The GitHub and LinkedIn OAuth2 backends are the affected call sites because they were added to a function with decades of accumulated semantic debt, likely without the benefit of earlier call-site examples demonstrating correct named-parameter syntax. Defenders should: First, verify whether your deployment uses GitHub or LinkedIn authentication backends — if not, you're not vulnerable. Second, examine the access rule configuration for virtual hosts; the shipped default grants access without validating `_user` or `authenticationLevel`, which is the actual bypass mechanism. Third, audit other call sites to `getApacheSession()` for similar positional-argument patterns — the same developer mistake may exist elsewhere in your tree. The non-obvious risk: the silent default-accept configuration shipped with the product creates an authentication bypass that requires no exploit sophistication beyond registering a GitHub OAuth client and replaying the state token. Organizations running this middleware should treat any unpatched deployment with GitHub/LinkedIn backends as actively vulnerable, regardless of other security controls, because the session namespace contamination happens before your access rules are evaluated.

Reviewed through automated stages and approved by a human before publication.