Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-9733— Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter

AI Predicted 6.5 Difficulty: Moderate EPSS 0.34% · P26

Possible ATT&CK Techniques 1AI

T1556.004 · Network Device Authentication

Affected Version Matrix 1

VendorProductVersion RangeStatus
HAYAJOMojolicious::Plugin::Web::Auth::OAuth2≤ 0.17affected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-9733

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter
Source: NVD (National Vulnerability Database)
Vulnerability Description
Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter. When no state generator is specified in the constructor, the module defaults to using a SHA-1 hash of predictable and low-entropy sources, including the epoch time (which is leaked via the HTTP Date header) and a call to Perl's built-in rand function. A predictable state allows an attacker to hijack another user's session through cross site request forgery (CSRF).
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
可预测问题
Source: NVD (National Vulnerability Database)
Vulnerability Title
HAYAJO Mojolicious::Plugin::Web::Auth::OAuth2 加密问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
HAYAJO Mojolicious::Plugin::Web::Auth::OAuth2是HAYAJO个人开发者开源的一个Web认证组件。 HAYAJO Mojolicious::Plugin::Web::Auth::OAuth2 0.17及之前版本存在加密问题漏洞，该漏洞源于默认状态参数不安全，当未指定状态生成器时，模块默认使用SHA-1哈希可预测的低熵源，包括epoch时间（通过HTTP Date标头泄露）和Perl内置rand函数，导致状态可预测，攻击者可利用跨站请求伪造劫持其他用户会话。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
HAYAJOMojolicious::Plugin::Web::Auth::OAuth2 0 ~ 0.17 -

II. Public POCs for CVE-2026-9733

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-9733

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-9733 (1)

Other References for CVE-2026-9733 (1)

IV. Related Vulnerabilities

Same vendor: HAYAJO
Same weakness: CWE-340

V. Comments for CVE-2026-9733

No comments yet

Leave a comment