PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-11832 BIAFRA CVE debrief

CVE-2026-11832 is a vulnerability in Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl. The plugin defaults to a predictable nonce generated using an MD5 hash of the epoch time.

Vendor
BIAFRA
Product
Dancer2::Plugin::Auth::OAuth
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-15
Original CVE updated
2026-06-16
Advisory published
2026-06-15
Advisory updated
2026-06-16

Who should care

Users of Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl should be aware of this vulnerability and take steps to mitigate it.

Technical summary

The default nonce was generated using an MD5 hash of the epoch time, which is predictable. This could potentially allow attackers to exploit the vulnerability.

Defensive priority

high

Recommended defensive actions

  • Update to version 0.22 or later of Dancer2::Plugin::Auth::OAuth
  • Use a secure random number generator to generate nonces

Evidence notes

The CVE record and NVD detail provide information on the vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-11832 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-11832

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-11832 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-11832

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://datatracker.ietf.org/doc/html/rfc5849

    9b29abf9-4ab0-4765-b253-1875cd9b441e

  • Source reference

    Unverified legacy reference

    URL: https://datatracker.ietf.org/doc/html/rfc5849

    9b29abf9-4ab0-4765-b253-1875cd9b441e

  • Source reference

    Unverified legacy reference

    URL: https://metacpan.org/release/BIAFRA/Dancer2-Plugin-Auth-OAuth-0.22/changes

    9b29abf9-4ab0-4765-b253-1875cd9b441e

  • Source reference

    Unverified legacy reference

    URL: https://www.cve.org/CVERecord?id=CVE-2025-22376

    9b29abf9-4ab0-4765-b253-1875cd9b441e

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.