PT-2026-49526 · Biafra · Dancer2::Plugin::Auth::Oauth

Published 2026-06-15 · Updated 2026-06-15 · CVE-2026-11832

Mitre

Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce.

The default nonce was generated using an MD5 hash of the epoch time, which is predictable.

Weakness Enumeration

CWE-338

Related Identifiers

CVE-2026-11832

Affected Products

Dancer2::Plugin::Auth::Oauth

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-11832 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-22376 · Security Note
• https://datatracker.ietf.org/doc/html/rfc5849#section-4.9 · Note
• https://metacpan.org/release/BIAFRA/Dancer2-Plugin-Auth-OAuth-0.22/changes · Note
• https://datatracker.ietf.org/doc/html/rfc5849#section-3.3 · Note