CVE-2026-9733

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-9733", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-05-27T17:25:58.644Z", "datePublished": "2026-06-23T07:05:20.564Z", "dateUpdated": "2026-06-23T14:18:05.692Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Mojolicious-Plugin-Web-Auth", "product": "Mojolicious::Plugin::Web::Auth::OAuth2", "programFiles": ["lib/Mojolicious/Plugin/Web/Auth/OAuth2.pm"], "programRoutines": [{"name": "Mojolicious::Plugin::Web::Auth::OAuth2::_state_generator"}], "repo": "https://github.com/hayajo/Mojolicious-Plugin-Web-Auth", "vendor": "HAYAJO", "versions": [{"lessThanOrEqual": "0.17", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter.\n\nWhen no state generator is specified in the constructor, the module defaults to using a SHA-1 hash of predictable and low-entropy sources, including the epoch time (which is leaked via the HTTP Date header) and a call to Perl's built-in rand function.\n\nA predictable state allows an attacker to hijack another user's session through cross site request forgery (CSRF)."}], "impacts": [{"capecId": "CAPEC-59", "descriptions": [{"lang": "en", "value": "CAPEC-59 Session Credential Falsification through Prediction"}]}, {"capecId": "CAPEC-62", "descriptions": [{"lang": "en", "value": "CAPEC-62 Cross Site Request Forgery"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-340", "description": "CWE-340 Generation of Predictable Numbers or Identifiers", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-338", "description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-06-23T07:05:20.564Z"}, "references": [{"url": "https://metacpan.org/release/HAYAJO/Mojolicious-Plugin-Web-Auth-0.17/source/lib/Mojolicious/Plugin/Web/Auth/OAuth2.pm#L129-131"}, {"tags": ["technical-description"], "url": "https://datatracker.ietf.org/doc/html/rfc6749#section-10.12"}, {"tags": ["patch"], "url": "https://security.metacpan.org/patches/M/Mojolicious-Plugin-Web-Auth/0.17/CVE-2026-9733-r2.patch"}], "source": {"discovery": "UNKNOWN"}, "title": "Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter", "workarounds": [{"lang": "en", "value": "Users should specify a state_generator function in the plugin configuration that uses a secure CSPRNG such as Crypt::PRNG or (for Mojolicious 9.46 or later) the Mojo::Util::random_bytes function. For example,\n\n plugin 'Web::Auth',\n module => 'OAuth2',\n ...\n state_generator => sub {\n unpack(\"H*\", Mojo::Util::random_bytes(20))\n };"}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/06/23/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-06-23T09:06:58.202Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-06-23T14:18:00.494484Z", "id": "CVE-2026-9733", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-23T14:18:05.692Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/06/23/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-06-23T09:06:58.202Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-9733", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-23T14:18:00.494484Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-23T14:17:54.395Z"}}], "cna": {"title": "Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-59", "descriptions": [{"lang": "en", "value": "CAPEC-59 Session Credential Falsification through Prediction"}]}, {"capecId": "CAPEC-62", "descriptions": [{"lang": "en", "value": "CAPEC-62 Cross Site Request Forgery"}]}], "affected": [{"repo": "https://github.com/hayajo/Mojolicious-Plugin-Web-Auth", "vendor": "HAYAJO", "product": "Mojolicious::Plugin::Web::Auth::OAuth2", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "0.17"}], "packageName": "Mojolicious-Plugin-Web-Auth", "programFiles": ["lib/Mojolicious/Plugin/Web/Auth/OAuth2.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Mojolicious::Plugin::Web::Auth::OAuth2::_state_generator"}]}], "references": [{"url": "https://metacpan.org/release/HAYAJO/Mojolicious-Plugin-Web-Auth-0.17/source/lib/Mojolicious/Plugin/Web/Auth/OAuth2.pm#L129-131"}, {"url": "https://datatracker.ietf.org/doc/html/rfc6749#section-10.12", "tags": ["technical-description"]}, {"url": "https://security.metacpan.org/patches/M/Mojolicious-Plugin-Web-Auth/0.17/CVE-2026-9733-r2.patch", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "Users should specify a state_generator function in the plugin configuration that uses a secure CSPRNG such as Crypt::PRNG or (for Mojolicious 9.46 or later) the Mojo::Util::random_bytes function. For example,\n\n plugin 'Web::Auth',\n module => 'OAuth2',\n ...\n state_generator => sub {\n unpack(\"H*\", Mojo::Util::random_bytes(20))\n };"}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter.\n\nWhen no state generator is specified in the constructor, the module defaults to using a SHA-1 hash of predictable and low-entropy sources, including the epoch time (which is leaked via the HTTP Date header) and a call to Perl's built-in rand function.\n\nA predictable state allows an attacker to hijack another user's session through cross site request forgery (CSRF)."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-340", "description": "CWE-340 Generation of Predictable Numbers or Identifiers"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-338", "description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-06-23T07:05:20.564Z"}}}, "cveMetadata": {"cveId": "CVE-2026-9733", "state": "PUBLISHED", "dateUpdated": "2026-06-23T14:18:05.692Z", "dateReserved": "2026-05-27T17:25:58.644Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-06-23T07:05:20.564Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Mojolicious-Plugin-Web-Auth", "product": "Mojolicious::Plugin::Web::Auth::OAuth2", "programFiles": ["lib/Mojolicious/Plugin/Web/Auth/OAuth2.pm"], "programRoutines": [{"name": "Mojolicious::Plugin::Web::Auth::OAuth2::_state_generator"}], "repo": "https://github.com/hayajo/Mojolicious-Plugin-Web-Auth", "vendor": "HAYAJO", "versions": [{"lessThanOrEqual": "0.17", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter.\n\nWhen no state generator is specified in the constructor, the module defaults to using a SHA-1 hash of predictable and low-entropy sources, including the epoch time (which is leaked via the HTTP Date header) and a call to Perl's built-in rand function.\n\nA predictable state allows an attacker to hijack another user's session through cross site request forgery (CSRF)."}, {"lang": "es", "value": "Las versiones de Mojolicious::Plugin::Web::Auth::OAuth2 hasta la 0.17 para Perl tienen un par\u00e1metro de estado predeterminado inseguro.\n\nCuando no se especifica ning\u00fan generador de estado en el constructor, el m\u00f3dulo recurre por defecto al uso de un hash SHA-1 de fuentes predecibles y de baja entrop\u00eda, incluyendo el tiempo de \u00e9poca (que se filtra a trav\u00e9s del encabezado HTTP Date) y una llamada a la funci\u00f3n rand incorporada de Perl.\n\nUn estado predecible permite a un atacante secuestrar la sesi\u00f3n de otro usuario mediante falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF)."}], "id": "CVE-2026-9733", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9733", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-23T14:18:00.494484Z", "version": "2.0.3"}}]}, "published": "2026-06-23T08:16:26.037", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://datatracker.ietf.org/doc/html/rfc6749#section-10.12"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/HAYAJO/Mojolicious-Plugin-Web-Auth-0.17/source/lib/Mojolicious/Plugin/Web/Auth/OAuth2.pm#L129-131"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://security.metacpan.org/patches/M/Mojolicious-Plugin-Web-Auth/0.17/CVE-2026-9733-r2.patch"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/06/23/1"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-338"}, {"lang": "en", "value": "CWE-340"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.17]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Mojolicious::Plugin::Web::Auth::OAuth2", "source": "cna", "vendor": "HAYAJO"}, "product": "mojolicious::plugin::web::auth::oauth2", "vendor": "hayajo"}], "created": "2026-06-23T09:30:06.793733+00:00", "updated": "2026-06-24T11:45:02.859230+00:00", "vendors": ["hayajo", "hayajo$PRODUCT$mojolicious::plugin::web::auth::oauth2"]}