CVE-2026-9733
Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter. When no state generator is specified in the constructor, the module defaults to using a SHA-1 hash of predictable and low-entropy sources, including the epoch time (which is leaked via the HTTP Date header) and a call to Perl's built-in rand function. A predictable state allows an attacker to hijack another user's session through cross site request forgery (CSRF).
| CWE | CWE-340 CWE-338 |
| Vendor | hayajo |
| Product | mojolicious::plugin::web::auth::oauth2 |
| Published | Jun 23, 2026 |
| Last Updated | Jun 23, 2026 |
Stay Ahead of the Next One
Get instant alerts for hayajo mojolicious::plugin::web::auth::oauth2
Be the first to know when new unknown vulnerabilities affecting hayajo mojolicious::plugin::web::auth::oauth2 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
HAYAJO / Mojolicious::Plugin::Web::Auth::OAuth2
0 ≤ 0.17
References
metacpan.org: https://metacpan.org/release/HAYAJO/Mojolicious-Plugin-Web-Auth-0.17/source/lib/Mojolicious/Plugin/Web/Auth/OAuth2.pm#L129-131 datatracker.ietf.org: https://datatracker.ietf.org/doc/html/rfc6749#section-10.12 security.metacpan.org: https://security.metacpan.org/patches/M/Mojolicious-Plugin-Web-Auth/0.17/CVE-2026-9733-r2.patch openwall.com: http://www.openwall.com/lists/oss-security/2026/06/23/1