What is the CVSS score of CVE-2026-11832?

CVE-2026-11832 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Dancer2 OAuth Plugin are affected by CVE-2026-11832?

Organizations using Dancer2::Plugin::Auth::OAuth for Perl face a critical authentication vulnerability enabling attackers to predict and replay OAuth requests, potentially granting unauthorized…. A patch is available.

How to fix or mitigate CVE-2026-11832?

Within 24 hours, audit your infrastructure and codebase for Dancer2::Plugin::Auth::OAuth dependency usage and document all affected applications. Within 7 days, upgrade all instances to version 0.22 from CPAN and redeploy with validation testing to confirm OAuth flows execute correctly. Within 30 days, review authentication logs for any anomalies, conduct penetration testing focused on OAuth replay scenarios, and document the patching in your security inventory.

Dancer2 OAuth Plugin CVE-2026-11832

EUVD-2026-37010 CRITICAL

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)

2026-06-15 CPANSec

GHSA-h3g4-wmrw-rm63

Information Disclosure Dancer2

9.1

CVSS 3.1 · Vendor: CPANSec

Severity by source

Vendor (CPANSec) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

6.8 MEDIUM

Network-reachable but realistic nonce prediction needs epoch timing and interaction with a live OAuth flow (AC:H, UI:R); no privileges needed (PR:N); auth integrity/confidentiality impact High, no availability effect.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Primary rating from Vendor (CPANSec).

CVSS VectorVendor: CPANSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 16:47 vuln.today

Patch available

Jun 15, 2026 - 23:02 EUVD

CVE Published

Jun 15, 2026 - 21:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 15, 2026 - 21:19 cve.org

CRITICAL 9.1

DescriptionCVE.org

Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce.

The default nonce was generated using an MD5 hash of the epoch time, which is predictable.

AnalysisAI

Predictable nonce generation in the Dancer2::Plugin::Auth::OAuth module for Perl (all versions before 0.22) weakens the OAuth authentication flow because the default nonce is derived from an MD5 hash of the current epoch time, a value an attacker can reconstruct or brute-force. Because the nonce is meant to guarantee request uniqueness and thwart replay/forgery, its predictability can let network attackers anticipate or replay authentication requests, undermining the confidentiality and integrity of the OAuth handshake. There is no public exploit identified at time of analysis and the vulnerability is not in CISA KEV; EPSS is low (0.19%, 9th percentile), but a vendor patch (0.22) is available.

Technical ContextAI

The affected component is a Perl authentication plugin (CPE cpe:2.3:a:biafra:dancer2::plugin::auth::oauth) that adds OAuth-based login to applications built on the Dancer2 web framework. In OAuth (RFC 5849 §3.3 and the secret-entropy guidance in §4.9, both cited in the references), the nonce combines with a timestamp to ensure every signed request is unique and cannot be replayed. The root cause maps to CWE-338 (Use of Cryptographically Weak Pseudo-Random Number Generator): rather than sourcing entropy from a CSPRNG, the plugin built the default nonce as MD5(epoch time). Since epoch seconds are low-entropy and externally observable, and MD5 is a fast, non-secret transform, the resulting nonce is effectively predictable, collapsing the uniqueness/unpredictability guarantee the nonce is supposed to provide.

RemediationAI

Vendor-released patch: upgrade Dancer2::Plugin::Auth::OAuth to version 0.22 or later, which replaces the predictable MD5-of-epoch default nonce with a properly random value; the fix is documented in the release changelog at https://metacpan.org/release/BIAFRA/Dancer2-Plugin-Auth-OAuth-0.22/changes and the advisory at https://seclists.org/oss-sec/2026/q2/938. Because this is a CPAN dependency, update via your Perl toolchain (e.g., cpanm Dancer2::Plugin::Auth::OAuth@0.22) and rebuild/redeploy the application. If you cannot upgrade immediately, the concrete compensating control is to override the plugin's nonce generation to use a cryptographically secure source (for example, supply a nonce derived from Crypt::URandom or /dev/urandom rather than time-based MD5), which removes the predictability but requires code-level customization and testing against your OAuth provider; additionally, enforce short-lived authorization requests and TLS everywhere to reduce the interception/replay window, accepting that these transport controls mitigate but do not eliminate the underlying weak-entropy problem.