This is a Perl signature collision vulnerability, not a simple typo. The root cause is that getApacheSession() accepts trailing positional arguments as implicit hash key-value pairs, and the codebase provides no schema enforcement to catch the mismatch.
When a developer calls getApacheSession( undef, 1, 0, 'GitHubState' ) instead of getApacheSession( undef, kind => 'GitHubState' ), Perl interprets the trailing arguments as hash pairs: {'1' => 0, 'GitHubState' => undef}. The function looks for a named parameter kind but finds only the implicit hash keys 1 and GitHubState, so it falls back to the default session type (SSO). The state identifier intended for CSRF validation is then stored in a session accessible to an unauthenticated caller — creating a replay token that can be used to hijack the OAuth2 flow.
This pattern is endemic to legacy Perl APIs using the trailing-hash idiom. The GitHub and LinkedIn OAuth2 backends are the affected call sites because they were added to a function with decades of accumulated semantic debt, likely without the benefit of earlier call-site examples demonstrating correct named-parameter syntax.
Defenders should: First, verify whether your deployment uses GitHub or LinkedIn authentication backends — if not, you're not vulnerable. Second, examine the access rule configuration for virtual hosts; the shipped default grants access without validating _user or authenticationLevel, which is the actual bypass mechanism. Third, audit other call sites to getApacheSession() for similar positional-argument patterns — the same developer mistake may exist elsewhere in your tree.
The non-obvious risk: the silent default-accept configuration shipped with the product creates an authentication bypass that requires no exploit sophistication beyond registering a GitHub OAuth client and replaying the state token. Organizations running this middleware should treat any unpatched deployment with GitHub/LinkedIn backends as actively vulnerable, regardless of other security controls, because the session namespace contamination happens before your access rules are evaluated.