CVE-2025-40905

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

WWW::OAuth 1.000 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-338

Affected software

Vendor	Product	Versions
DBOOK	WWW::OAuth	<= 1.000

References

https://metacpan.org/release/DBOOK/WWW-OAuth-1.000/source/lib/WWW/OAuth.pm#L86Issue Tracking, Product
https://perldoc.perl.org/functions/randThird Party Advisory
https://security.metacpan.org/docs/guides/random-data-for-security.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2026/02/13/1Mailing List, Third Party Advisory

Timeline

Published: Feb 13, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-409069.8BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities. Those include CVE-2017-14 CVE-2025-409075.3FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library. The included FastCGI libra CVE-2025-409089.1YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified CVE-2025-409095.9Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at th CVE-2025-40918.1Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9. Some of these bugs showed evidence of CVE-2025-409106.5Net::IP::LPM version 1.10 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow attacker CVE-2025-409116.5Net::CIDR::Set versions 0.10 through 0.13 for Perl does not properly handle leading zero characters in IP CIDR address strings, which could CVE-2025-409129.8CryptX for Perl before version 0.065 contains a dependency that may be susceptible to malformed unicode. CryptX embeds the tomcrypt library CVE-2025-409136.5Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow. Net::Dropbear embeds a v CVE-2025-409149.8Perl CryptX before version 0.087 contains a dependency that may be susceptible to an integer overflow. CryptX embeds a version of the libto CVE-2025-409157.0Mojolicious::Plugin::CSRF 1.03 for Perl uses a weak random number source for generating CSRF tokens. That version of the module generates t CVE-2025-409169.1Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a weak random number source for generating the captcha. That version uses the bu