Nonce Predictability in Dancer2::Plugin::Auth::OAuth for Perl
CVE-2026-11832

9.1CRITICAL

Key Information:

Vendor

Biafra

Status
Dancer2::plugin::auth::oauth
Vendor
CVE Published:
15 June 2026

What is CVE-2026-11832?

The Dancer2::Plugin::Auth::OAuth versions prior to 0.22 exhibit a vulnerability where the nonce generation mechanism relies on an MD5 hash of the epoch time, making it predictable. This predictability can allow attackers to replay requests, compromising the integrity and confidentiality of OAuth transactions.

Affected Version(s)

Dancer2::Plugin::Auth::OAuth 0 < 0.22

References

https://metacpan.org/release/BIAFRA/Dancer2-Plugin-Auth-O...
release-notes
https://www.cve.org/CVERecord?id=CVE-2025-22376
related
https://datatracker.ietf.org/doc/html/rfc5849#section-3.3

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.