CVE-2026-11832: Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce

Synopsis

An authentication bypass vulnerability exists in Dancer2::Plugin::Auth::OAuth for Perl in versions before 0.22. The plugin generates its OAuth nonce (a single-use random token meant to prevent replay attacks) using an MD5 hash of the current epoch time, making it trivially predictable by any unauthenticated attacker over the network. A successful attacker can forge or replay OAuth requests, gaining unauthorized read and write access to protected resources without valid credentials. A patched-image rebuild at version 0.22 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service must be reachable over the network; an attacker can send crafted OAuth requests from any internet-accessible vantage point without requiring local or adjacent access.

• AuthenticationNot required

  No credentials or prior account are needed; the predictable nonce can be computed and exploited by a fully unauthenticated attacker.

• Victim interactionNot required

  Exploitation is fully server-side; no user action, click, or browser navigation is required to trigger the vulnerable nonce validation path.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and condition-free; an attacker only needs to compute the MD5 of the current or recent epoch timestamp to predict the nonce.

Blast Radius

• An attacker can forge or replay OAuth authentication requests, bypassing access controls and assuming the identity of legitimate users or services.
• Confidential data accessible to impersonated accounts, such as session tokens, API credentials, and user records, is exposed to the attacker.
• An attacker can modify or submit data on behalf of impersonated identities, including writing records, changing account state, or invoking privileged API actions.