CVE-2026-9733

Affected software: Mojolicious::Plugin::Web::Auth::OAuth2 (Perl) up to version 0.17. Root cause: when no state generator is set, the module uses a SHA-1 hash of low-entropy sources (including epoch time leaked via the HTTP Date header) and Perl rand(), producing a predictable OAuth2 state. Impact...