Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter. When no state generator is specified in the constructor, the module defaults to using a SHA-1 hash of predictable and low-entropy sources, including the epoch time (which is leaked via the HTTP Date header) and a call to Perl's built-in rand function. A predictable state allows an attacker to hijack another user's session through cross site request forgery (CSRF).
When the state parameter generator is not explicitly specified in the module constructor, the module defaults to computing a SHA-1 hash from predictable data: epoch time and the value returned by the Perl built-in rand function. The epoch time is additionally disclosed to the attacker via the HTTP Date header. With this information, the attacker can reproduce the state parameter value with high probability and use it to forge an OAuth2 request on behalf of the victim (CSRF attack as per RFC 6749 section 10.12).
An attacker can hijack another user's OAuth2 session by fabricating a valid state parameter, which in practice can lead to unauthorized access to the victim's account on a service using this authentication mechanism.
The patch provided by the manufacturer should be applied: CVE-2026-9733-r2.patch available at the address indicated in the references (security.metacpan.org). Until the update is applied, it is recommended to explicitly configure a cryptographically secure state parameter generator in the module constructor.
Mojolicious::Plugin::Web::Auth::OAuth2 in versions up to and including 0.17 for Perl
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N