CVE-2026-9733 Details
Description
Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter. When no state generator is specified in the constructor, the module defaults to using a SHA-1 hash of predictable and low-entropy sources, including the epoch time (which is leaked via the HTTP Date header) and a call to Perl's built-in rand function. A predictable state allows an attacker to hijack another user's session through cross site request forgery (CSRF).
A vulnerability exists in Mojolicious::Plugin::Web::Auth::OAuth2, all versions up to 0.17, for Perl. The issue arises from an insecure default state parameter. When the constructor does not specify a state generator, the module defaults to a SHA-1 hash derived from predictable, low-entropy sources. These include the epoch time, which is exposed through the HTTP Date header, and a call to Perl's rand function. This predictability allows an attacker to hijack another user's session via cross-site request forgery (CSRF).
Users can update to Mojolicious::Plugin::Web::Auth::OAuth2 version 0.18 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 23, 2026CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://datatracker.ietf.org/doc/html/rfc6749#section-10.12 | CPANSec | Content Wall |
| https://metacpan.org/release/HAYAJO/Mojolicious-Plugin-Web-Auth-0.17/source/lib/Mojolicious/Plugin/Web/Auth/OAuth2.pm#L129-131 | CPANSec | Source CodeVendor |
| https://security.metacpan.org/patches/M/Mojolicious-Plugin-Web-Auth/0.17/CVE-2026-9733-r2.patch | CPANSec | Broken LinkSource CodeVendor |
| http://www.openwall.com/lists/oss-security/2026/06/23/1 | CVE |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | CPANSec |
| CWE-340 | Generation of Predictable Numbers or Identifiers | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| Mojolicious::Plugin::Web::Auth::OAuth2 | <= 0.17 |
CPE
Remediation | |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 23, 2026 | CVE Modified | CVE |
| Jun 23, 2026 | New CVE Received | CPANSec |