p PatchFirst

PatchFirst · Latest vulnerabilities

guzzlehttp/oauth-subscriber vulnerabilities

Vulnerabilities published for guzzlehttp/oauth-subscriber in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerability: 1

  1. CVE-2025-21617

    Medium · CVSS 6.3EPSS 0.48%Fix available

    Guzzle OAuth Subscriber has insufficient nonce entropy

    Guzzle OAuth Subscriber signs Guzzle requests using OAuth 1.0. Prior to 0.8.1, Nonce generation does not use sufficient entropy nor a cryptographically secure pseudorandom source. This can leave servers vulnerable to replay attacks when TLS is not used. This vulnerability is fixed in 0.8.1.

    guzzlehttp/oauth-subscriberPHP
    • Update to 0.8.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →