CVE-2026-9733

Name of the Vulnerable Software and Affected Versions Mojolicious::Plugin::Web::Auth::OAuth2 versions prior to 0.18

Description The module uses an insecure default state parameter when no state generator is specified in the constructor. It generates a SHA-1 hash using predictable, low-entropy sources, specifically the epoch time—which is exposed in the HTTP Date header—and the built-in Perl rand function. This predictability enables an attacker to perform cross site request forgery (CSRF), a technique used to trick a user into executing unwanted actions on a web application, potentially leading to session hijacking.

Recommendations Update to a version newer than 0.17. As a temporary mitigation, specify a secure state generator in the constructor instead of relying on the default setting.