Predictable nonce in Dancer2::Plugin::Auth::OAuth for Perl (CVE-2026-11832)

Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a nonce generated using an MD5 hash of the epoch time, which is predictable. This constitutes use of a cryptographically weak pseudo-random number generator (CWE-338), potentially allowing an attacker to predict nonce values used in OAuth flows. Affected versions: - before 0.22 We recommend updating to: 0.22. CVSS 9.1 · our assessment: act_now Reference: https://seclists.org/oss-sec/2026/q2/938 Details: https://vuln.today/cve/CVE-2026-11832