CVE-2026-9733

CriticalCVSS 9.1/10Last modified Jun 23, 2026

Description

Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter.

When no state generator is specified in the constructor, the module defaults to using a SHA-1 hash of predictable and low-entropy sources, including the epoch time (which is leaked via the HTTP Date header) and a call to Perl's built-in rand function.

A predictable state allows an attacker to hijack another user's session through cross site request forgery (CSRF).

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-338 CWE-340

Affected software

No affected versions have been published.

Timeline

Published: Jun 23, 2026
Last modified: Jun 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-973314.3The User Private Files WordPress plugin before 2.1.9 does not validate that a supplied user belongs to the document being operated on befor CVE-2026-973325.3The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, where t CVE-2026-973337.1QAPI contained a stack-based buffer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Up CVE-2026-973348.7The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrad CVE-2026-973357.7Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later (fixed in 5.0.10, 5.21.8 an CVE-2026-973367.2The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'file_list' Field Type in all versions up to, and including, CVE-2026-973377.5The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive information disclosure in versio CVE-2026-973386.4The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Display Name in all versions up to, and including CVE-2026-973397.2The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu CVE-2026-97344.3The W3SC Elementor to Zoho CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0.CVE-2026-973406.4The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Stored Cross-Site Scripting via the user profil CVE-2026-973417.2The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP He