Skip to content
OpenAdvisories
Critical · 9.1 CVE-2026-11832 EUVD-2026-37010GHSA-h3g4-wmrw-rm63

Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce

Published Jun 15, 2026 · Updated Jun 16, 2026 · Assigned by CPANSec

Vendor: BIAFRA Product: Dancer2::Plugin::Auth::OAuth

Description

Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce.

The default nonce was generated using an MD5 hash of the epoch time, which is predictable.

Affected products

VendorProductAffectedFixed
BIAFRA Dancer2::Plugin::Auth::OAuth < 0.22 0.22

References