CVE-2025-40905

WWW::OAuth 1.000 and earlier for Perl uses insecure rand() function for cryptographic functions

State: Published
Severity: 7.3 High
Published: Feb 12, 2026
Updated: Feb 17, 2026
Reserved: Apr 16, 2025

Description

WWW::OAuth 1.000 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.

Scores

CVSS	Score	Vector	Source
3.1	7.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L	CISA-ADP

Weaknesses

CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Affected Products

Product	Versions
WWW::OAuthDBOOK	1.000 and earlierAffected

References

https://perldoc.perl.org/functions/rand
https://security.metacpan.org/docs/guides/random-data-for-security.html
https://metacpan.org/release/DBOOK/WWW-OAuth-1.000/source/lib/WWW/OAuth.pm#L86
http://www.openwall.com/lists/oss-security/2026/02/13/1

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.