Dancer2
Monthly
Predictable nonce generation in the Dancer2::Plugin::Auth::OAuth module for Perl (all versions before 0.22) weakens the OAuth authentication flow because the default nonce is derived from an MD5 hash of the current epoch time, a value an attacker can reconstruct or brute-force. Because the nonce is meant to guarantee request uniqueness and thwart replay/forgery, its predictability can let network attackers anticipate or replay authentication requests, undermining the confidentiality and integrity of the OAuth handshake. There is no public exploit identified at time of analysis and the vulnerability is not in CISA KEV; EPSS is low (0.19%, 9th percentile), but a vendor patch (0.22) is available.
Predictable nonce generation in the Dancer2::Plugin::Auth::OAuth module for Perl (all versions before 0.22) weakens the OAuth authentication flow because the default nonce is derived from an MD5 hash of the current epoch time, a value an attacker can reconstruct or brute-force. Because the nonce is meant to guarantee request uniqueness and thwart replay/forgery, its predictability can let network attackers anticipate or replay authentication requests, undermining the confidentiality and integrity of the OAuth handshake. There is no public exploit identified at time of analysis and the vulnerability is not in CISA KEV; EPSS is low (0.19%, 9th percentile), but a vendor patch (0.22) is available.