PT-2026-7944 · Unknown · Www::Oauth

Robert Rothenberg · Published 2025-01-01 · Updated 2026-02-18 · CVE-2025-40905

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions WWW::OAuth versions 1.000 and earlier

Description The software utilizes the rand() function as the default source of entropy for cryptographic functions, which is not cryptographically secure. This can potentially compromise the security of cryptographic operations.

Recommendations Versions prior to 1.000 should be updated. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-338

Related Identifiers

CVE-2025-40905

Affected Products

Www::Oauth

References · 18

• https://cve.org/CVERecord?id=CVE-2025-40905 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-40905 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-40905 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-40905 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-40905 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-40905 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40905 · Vendor Advisory
• https://t.me/CVEtracker/44589 · Telegram Post
• https://twitter.com/cracbot/status/2024076468255662522 · Twitter Post
• https://t.me/cveNotify/151909 · Telegram Post
• http://openwall.com/lists/oss-security/2026/02/13/1 · Note
• https://perldoc.perl.org/functions/rand · Note
• https://lists.security.metacpan.org/cve-announce/msg/36977848 · Note
• https://twitter.com/CVEnew/status/2022096942419882447 · Twitter Post
• https://security.metacpan.org/docs/guides/random-data-for-security.html · Note