EUVD-2026-38421
GHSA-rq65-66g5-5pg2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CSRF session hijack needs victim to click attacker link (UI:R) and successful rand()/epoch prediction (AC:H); no auth needed; full session C/I impact, no availability effect.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter.
When no state generator is specified in the constructor, the module defaults to using a SHA-1 hash of predictable and low-entropy sources, including the epoch time (which is leaked via the HTTP Date header) and a call to Perl's built-in rand function.
A predictable state allows an attacker to hijack another user's session through cross site request forgery (CSRF).
AnalysisAI
CSRF session hijacking in Mojolicious::Plugin::Web::Auth::OAuth2 through version 0.17 for Perl stems from a predictable default state parameter built from a SHA-1 hash of leaked epoch time and Perl's weak rand(). Remote attackers can guess or precompute valid state values to forge OAuth2 authorization responses and bind a victim's session to an attacker-controlled identity. No public exploit identified at time of analysis, EPSS is low (0.19%, 8th percentile), and a vendor patch is available.
Technical ContextAI
Mojolicious::Plugin::Web::Auth::OAuth2 is a Perl module that implements the OAuth2 client flow on top of the Mojolicious web framework, handling redirects to identity providers and validating callback responses. RFC 6749 §10.12 requires the OAuth2 'state' parameter to be a cryptographically unguessable, per-session value to defend the redirect_uri callback against CSRF. The affected versions (cpe:2.3:a:hayajo:mojolicious::plugin::web::auth::oauth2 through 0.17) instead default to SHA1(epoch_time . rand()), where the epoch timestamp is exposed in the HTTP Date response header and Perl's built-in rand() is a non-cryptographic PRNG, producing a state space attackers can reconstruct. This is a textbook CWE-340 (Predictable from Observable State) weakness applied to a security-critical anti-CSRF token.
RemediationAI
Patch available per vendor advisory: apply the official fix from https://security.metacpan.org/patches/M/Mojolicious-Plugin-Web-Auth/0.17/CVE-2026-9733-r2.patch and upgrade to the corresponding fixed release of Mojolicious-Plugin-Web-Auth once published on CPAN, as referenced in the oss-security advisory https://seclists.org/oss-sec/2026/q2/1001 and VulDB entry https://vuldb.com/vuln/372875. As an immediate compensating control until the upgrade is rolled out, supply an explicit cryptographically strong state generator to the plugin constructor (for example one backed by Crypt::URandom or Bytes::Random::Secure producing at least 128 bits of entropy bound to the user session), which removes reliance on the vulnerable default with no functional side effects beyond a one-line configuration change. Additionally validate that the returned state matches the per-session stored value on the OAuth2 callback and review logs for anomalous callback patterns; suppressing the HTTP Date header is not a reliable mitigation because rand() alone remains predictable.
More in Mojolicious
View allMojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC sessio
CSRF token disclosure in the Perl Mojolicious web framework (versions 4.59 up to but not including 9.48) allows a networ
Predictable session ID generation in Mojolicious::Sessions::Storable through version 0.05 for Perl exposes applications
Share
External POC / Exploit Code
Leaving vuln.today