CVE-2025-21617
CVE-2025-21617 · Guzzle OAuth Subscriber has insufficient nonce entropy
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Guzzle OAuth Subscriber signs Guzzle requests using OAuth 1.0. Prior to 0.8.1, Nonce generation does not use sufficient entropy nor a cryptographically secure pseudorandom source. This can leave servers vulnerable to replay attacks when TLS is not used. This vulnerability is fixed in 0.8.1.
CVSS 6.3 · Medium · EPSS 0.5% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
oauth-subscriber
- Versions
- < 0.8.1: Affected
No fix published
guzzlehttp/oauth-subscriber Packagist
- Versions
- 0.1.0
- 0.1.1
- 0.1.2
- 0.2.0
- 0.3.0
- 0.4.0
- 0.5.0
- 0.6.0
- 0.7.0
- 0.8.0
- Affected ranges
- ECOSYSTEM: < 0.8.1
Update to 0.8.1
Original sources
- https://github.com/guzzle/oauth-subscriber/security/advisories/GHSA-237r-r8m4-4q88
- https://github.com/guzzle/oauth-subscriber/commit/92b619b03bd21396e51c62e6bce83467d2ce8f53
- https://github.com/guzzle/oauth-subscriber/blob/0.8.0/src/Oauth1.php#L192
- https://github.com/guzzle/oauth-subscriber/releases/tag/0.8.1
- https://nvd.nist.gov/vuln/detail/CVE-2025-21617