CVE-2025-21617 — Guzzle OAuth Subscriber has insufficient nonce entropy
Guzzle OAuth Subscriber signs Guzzle requests using OAuth 1.0. Prior to 0.8.1, Nonce generation does not use sufficient entropy nor a cryptographically secure pseudorandom sourc…
Published: 2025-01-06 · CVSS: 6.3 · CVSS 4.0
Guzzle OAuth Subscriber signs Guzzle requests using OAuth 1.0. Prior to 0.8.1, Nonce generation does not use sufficient entropy nor a cryptographically secure pseudorandom source. This can leave servers vulnerable to replay attacks when TLS is not used. This vulnerability is fixed in 0.8.1.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7