CVE-2026-9733

Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter. When no state generator is specified in the constructor, the module defaults to using a SHA-1 hash of predictable and low-entropy sources, including the epoch time (which is leaked via the HTTP Date header) and a call to Perl's built-in rand function. A predictable state allows an attacker to hijack another user's session through cross site request forgery (CSRF).

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://datatracker.ietf.org/doc/html/rfc6749#section-10.12
https://metacpan.org/release/HAYAJO/Mojolicious-Plugin-Web-Auth-0.17/source/lib/Mojolicious/Plugin/Web/Auth/OAuth2.pm#L129-131
https://security.metacpan.org/patches/M/Mojolicious-Plugin-Web-Auth/0.17/CVE-2026-9733-r2.patch
http://www.openwall.com/lists/oss-security/2026/06/23/1

Configurations

No configuration.

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de Mojolicious::Plugin::Web::Auth::OAuth2 hasta la 0.17 para Perl tienen un parámetro de estado predeterminado inseguro. Cuando no se especifica ningún generador de estado en el constructor, el módulo recurre por defecto al uso de un hash SHA-1 de fuentes predecibles y de baja entropía, incluyendo el tiempo de época (que se filtra a través del encabezado HTTP Date) y una llamada a la función rand incorporada de Perl. Un estado predecible permite a un atacante secuestrar la sesión de otro usuario mediante falsificación de petición en sitios cruzados (CSRF).

Information

Published : 2026-06-23 08:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-9733

Mitre link : CVE-2026-9733

CVE.ORG link : CVE-2026-9733

JSON object : View

Products Affected

No product.

CWE

CWE-338

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

CWE-340

Generation of Predictable Numbers or Identifiers

{"id": "CVE-2026-9733", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9733", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-23T14:18:00.494484Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/hayajo/Mojolicious-Plugin-Web-Auth", "vendor": "HAYAJO", "product": "Mojolicious::Plugin::Web::Auth::OAuth2", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "0.17"}], "packageName": "Mojolicious-Plugin-Web-Auth", "programFiles": ["lib/Mojolicious/Plugin/Web/Auth/OAuth2.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Mojolicious::Plugin::Web::Auth::OAuth2::_state_generator"}]}]}], "published": "2026-06-23T08:16:26.037", "references": [{"url": "https://datatracker.ietf.org/doc/html/rfc6749#section-10.12", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/HAYAJO/Mojolicious-Plugin-Web-Auth-0.17/source/lib/Mojolicious/Plugin/Web/Auth/OAuth2.pm#L129-131", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://security.metacpan.org/patches/M/Mojolicious-Plugin-Web-Auth/0.17/CVE-2026-9733-r2.patch", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2026/06/23/1", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-338"}, {"lang": "en", "value": "CWE-340"}]}], "descriptions": [{"lang": "en", "value": "Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter.\n\nWhen no state generator is specified in the constructor, the module defaults to using a SHA-1 hash of predictable and low-entropy sources, including the epoch time (which is leaked via the HTTP Date header) and a call to Perl's built-in rand function.\n\nA predictable state allows an attacker to hijack another user's session through cross site request forgery (CSRF)."}, {"lang": "es", "value": "Las versiones de Mojolicious::Plugin::Web::Auth::OAuth2 hasta la 0.17 para Perl tienen un par\u00e1metro de estado predeterminado inseguro.\n\nCuando no se especifica ning\u00fan generador de estado en el constructor, el m\u00f3dulo recurre por defecto al uso de un hash SHA-1 de fuentes predecibles y de baja entrop\u00eda, incluyendo el tiempo de \u00e9poca (que se filtra a trav\u00e9s del encabezado HTTP Date) y una llamada a la funci\u00f3n rand incorporada de Perl.\n\nUn estado predecible permite a un atacante secuestrar la sesi\u00f3n de otro usuario mediante falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF)."}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}