https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T06:26:06.200216+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-329229 EUVD-2026-329229 2026-10-05T06:26:06.254722+00:00 EUVD-2026-329229 https://cve.radiocsirt.org/vuln/fkie_cve-2026-9733 fkie_cve-2026-9733 2026-10-05T06:26:06.254781+00:00

Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter.

When no state generator is specified in the constructor, the module defaults to using a SHA-1 hash of predictable and low-entropy sources, including the epoch time (which is leaked via the HTTP Date header) and a call to Perl's built-in rand function.

A predictable state allows an attacker to hijack another user's session through cross site request forgery (CSRF).

 https://cve.radiocsirt.org/vuln/ghsa-rq65-66g5-5pg2 GHSA-rq65-66g5-5pg2 2026-10-05T06:26:06.254845+00:00

Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter.

When no state generator is specified in the constructor, the module defaults to using a SHA-1 hash of predictable and low-entropy sources, including the epoch time (which is leaked via the HTTP Date header) and a call to Perl's built-in rand function.

A predictable state allows an attacker to hijack another user's session through cross site request forgery (CSRF).