Executive brief
A security vulnerability exists in a Perl library used for handling OAuth authentication in web applications. The software uses a predictable method to generate security tokens (nonces), which are intended to be unique and random to prevent replay attacks. If an attacker can predict these tokens, they may be able to bypass certain security checks during the login or authorization process.
Technical details
Dancer2::Plugin::Auth::OAuth before version 0.22 utilizes a cryptographically weak pseudo-random number generator (PRNG) for nonce generation. Specifically, the default nonce is generated by taking an MD5 hash of the current epoch time. Because epoch time is easily guessable or enumerable, the resulting nonce is predictable. This violates the security requirements of the OAuth 1.0 protocol (RFC 5849), potentially allowing for replay attacks or other session-related exploits. The issue is addressed in version 0.22 by implementing a more secure nonce generation mechanism.
Affected products
- Perl Dancer2 Project Dancer2::Plugin::Auth::OAuth before 0.22
Timeline
- 2026-06-15: disclosed
- 2026-06-15: advisory