Nonce Vulnerability in Catalyst Authentication Credential for Perl
CVE-2025-40920

8.6HIGH

Key Information:

Vendor

Ether

Status
Catalyst::authentication::credential::http
Vendor
CVE Published:
11 August 2025

What is CVE-2025-40920?

The Catalyst::Authentication::Credential::HTTP module for Perl versions 1.018 and earlier is vulnerable due to its use of the Perl Data::UUID library for nonce generation. This library produces version 3 UUIDs that are not suitable for secure applications, as they are derived from known inputs rather than strong cryptographic sources as recommended by RFC 7616. This lack of secure nonce generation can potentially compromise authentication integrity, making it imperative for users to upgrade to patched versions to rectify the security weakness.

Affected Version(s)

Catalyst::Authentication::Credential::HTTP 0.06 <= 1.018

References

https://github.com/perl-catalyst/Catalyst-Authentication-...
patch
https://github.com/perl-catalyst/Catalyst-Authentication-...
issue-tracking
https://metacpan.org/release/ETHER/Catalyst-Authenticatio...

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-40920 : Nonce Vulnerability in Catalyst Authentication Credential for Perl