Skip to content
OpenAdvisories

Package · Packagist

guzzlehttp/oauth-subscriber

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.3
    CVE-2025-21617

    Guzzle OAuth Subscriber has insufficient nonce entropy

    Guzzle OAuth Subscriber signs Guzzle requests using OAuth 1.0. Prior to 0.8.1, Nonce generation does not use sufficient entropy nor a cryptographically secure pseudorandom source. This can leave servers vulnerable to replay attacks when TLS is not used. This …

    guzzle oauth-subscriber guzzlehttp/oauth-subscriber Packagist