PUBLISHED
2026-06-23 08:16
MODIFIED
2026-06-23 08:16
EPSS (Prob. Exploit)
0.52%
Top 56.5%
> DESCRIPTION
Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter.
When no state generator is specified in the constructor, the module defaults to using a SHA-1 hash of predictable and low-entropy sources, including the epoch time (which is leaked via the HTTP Date header) and a call to Perl's built-in rand function.
A predictable state allows an attacker to hijack another user's session through cross site request forgery (CSRF).
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) - The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong. | CWE-340: Generation of Predictable Numbers or Identifiers - The product uses a scheme that generates numbers or identifiers that are more predictable than required.
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter
AFFECTED PACKAGES:
Unknown / Unknown
17 versions affected
> HISTORIQUE DES MODIFICATIONS
Première apparition
23/06/2026 08:16
Source: NVD
📊
ENRICHISSEMENT
01/07/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) - The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptogra...
Total des modifications: 1
Dernière mise à jour: 4 months ago