← Database

CVE-2025-21617

N/A CVSS: N/A Published: 2025-01-06 Modified: 2026-06-17

Description

Guzzle OAuth Subscriber signs Guzzle requests using OAuth 1.0. Prior to 0.8.1, Nonce generation does not use sufficient entropy nor a cryptographically secure pseudorandom source. This can leave servers vulnerable to replay attacks when TLS is not used. This vulnerability is fixed in 0.8.1.

Affected Platforms

Unknown

Weakness Type

CWE-338

References