CVE-2026-9733: Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter

Synopsis

This is an insecure-default CSRF protection bypass in Mojolicious::Plugin::Web::Auth::OAuth2 (Perl), versions through 0.17. The module generates its OAuth2 state parameter using a SHA-1 hash of low-entropy inputs including epoch time (leaked in the HTTP Date response header) and Perl's weak built-in rand function, making the state value predictable to a remote attacker. A successful attacker can hijack a victim user's OAuth2 session without any credentials, completing an account takeover via CSRF. No upstream fix has been published; HarborGuard tracks the advisory and will make a patched rebuild available as soon as one is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected web service over the network to intercept or replay the predictable OAuth2 state parameter.

• AuthenticationNot required

  No account or credentials are required; the attack is possible from an unauthenticated position against a victim who is actively initiating an OAuth2 login flow.

• Victim interactionRequired

  The attack requires a victim user to initiate an OAuth2 authorization flow, which the attacker can then hijack by forging the predictable state value.

• Attack complexityDetail

  The exploit is reliable and condition-free once the attacker observes the HTTP Date header, as epoch time and Perl's rand output provide sufficient entropy to enumerate candidate state values quickly.

Blast Radius

• Attacker binds a victim's OAuth2 authorization code to their own session, gaining full access to the victim's account within the application.
• Reads any data accessible to the hijacked user account, including session tokens, personal information, and application-specific records.
• Modifies application state and persisted data on behalf of the hijacked user, including profile changes, transactions, or any write operations the user is authorized to perform.