CVE-2026-9733: Mojolicious OAuth2 Plugin CSRF Vulnerability

CVE-2026-9733 Overview

CVE-2026-9733 affects Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl. The module uses an insecure default state parameter generator when none is supplied in the constructor. The default implementation builds a SHA-1 hash from predictable, low-entropy inputs, including the epoch time leaked via the HTTP Date header and a call to Perl's built-in rand function. An attacker who can predict the state value can forge an OAuth2 authorization response and hijack another user's session through cross-site request forgery (CSRF) [CWE-338].

Critical Impact
A network attacker can predict OAuth2 state values and hijack authenticated user sessions without any user interaction or prior privileges.

Affected Products

Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17
Perl applications using the affected module without a custom state generator
Web services relying on the default OAuth2 CSRF protection provided by this plugin

Discovery Timeline

2026-06-23 - CVE CVE-2026-9733 published to NVD
2026-06-23 - Disclosure discussed on the OpenWall OSS-Security list
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-9733

Vulnerability Analysis

The OAuth2 state parameter, as described in RFC 6749 Section 10.12, must be unguessable to prevent CSRF attacks against the authorization endpoint. The affected plugin generates this value by hashing predictable inputs with SHA-1. Because the inputs lack sufficient entropy, an attacker can reproduce the same state value externally and pair it with a malicious authorization callback.

The issue is classified as [CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)]. The downstream effect is authentication context confusion, allowing the attacker's OAuth2 identity or tokens to bind to the victim's session.

Root Cause

The root cause is the use of weak entropy sources in the default state generator. The module derives state from the current epoch time and Perl's rand function, then applies SHA-1. The epoch time is observable in HTTP Date response headers, and rand is a non-cryptographic PRNG with a small, recoverable internal state. SHA-1 over predictable inputs does not add entropy. See the MetaCPAN source reference for the affected code path.

Attack Vector

An attacker initiates an OAuth2 authorization flow against the vulnerable application and observes the Date header to anchor the epoch time. The attacker brute-forces the small rand search space to recover a candidate state. The attacker then lures a victim to a crafted callback URL containing the predicted state and an attacker-controlled authorization code. The application accepts the callback as legitimate, binding the attacker's identity provider session to the victim's browser session.

No authentication or user interaction beyond visiting a crafted link is required. The vulnerability is exploitable over the network against any deployment using the default state generator.

Detection Methods for CVE-2026-9733

Indicators of Compromise

OAuth2 callback requests where the state value matches a value computable from a recent server Date header and a low-entropy rand seed.
Repeated authorization callbacks from the same client IP with sequential or closely timed state values.
Session identity changes immediately following an OAuth2 callback without a preceding user-initiated login flow.

Detection Strategies

Inventory Perl applications and CPAN dependencies for Mojolicious::Plugin::Web::Auth at version 0.17 or earlier.
Inspect application code for instantiation of the OAuth2 plugin without an explicit state generator argument.
Add server-side logging that records the state value, callback timestamp, and resulting user identity for every OAuth2 callback to enable retrospective analysis.

Monitoring Recommendations

Alert on OAuth2 callbacks that arrive without a corresponding outbound authorization request from the same session within a short time window.
Correlate authentication provider events with application session creation events to detect identity-to-session mismatches.
Monitor for anomalous spikes in failed OAuth2 callbacks, which can indicate state brute-force attempts.

How to Mitigate CVE-2026-9733

Immediate Actions Required

Upgrade Mojolicious::Plugin::Web::Auth to a release that includes the fix referenced in the MetaCPAN CVE-2026-9733 patch.
Audit all OAuth2 plugin instantiations and supply an explicit state generator that uses a cryptographically secure source such as Crypt::URandom or /dev/urandom.
Invalidate active sessions established through OAuth2 flows during the exposure window and force users to reauthenticate.

Patch Information

A patch is available from MetaCPAN at CVE-2026-9733-r2.patch. The fix replaces the predictable SHA-1 over epoch and rand construction with a cryptographically secure random state generator. Apply the patch or upgrade to a fixed release, then redeploy affected services.

Workarounds

Pass a custom state generator to the plugin constructor that returns at least 128 bits of output from a cryptographically secure random source.
Bind OAuth2 state values to the user's pre-authentication session identifier and reject callbacks where the binding does not match.
Restrict OAuth2 callback handling to short validity windows, reducing the time available for state prediction.

bash

# Configuration example: supply a CSPRNG-backed state generator
cpanm Mojolicious::Plugin::Web::Auth
# In application code, instantiate the plugin with an explicit generator:
#   $self->plugin('Web::Auth',
#     module => 'Facebook',
#     key    => $key,
#     secret => $secret,
#     state  => sub { require Crypt::URandom;
#                     unpack('H*', Crypt::URandom::urandom(32)) },
#   );