CVE-2025-21617 Guzzle OAuth Subscriber has insufficient nonce entropy

Guzzle OAuth Subscriber signs Guzzle requests using OAuth 1.0. Prior to 0.8.1, Nonce generation does not use sufficient entropy nor a cryptographically secure pseudorandom source. This can leave servers vulnerable to replay attacks when TLS is not used. This vulnerability is fixed in 0.8.1...

CVE-2025-21617 Guzzle OAuth Subscriber has insufficient nonce entropy

Guzzle OAuth Subscriber signs Guzzle requests using OAuth 1.0. Prior to 0.8.1, Nonce generation does not use sufficient entropy nor a cryptographically secure pseudorandom source. This can leave servers vulnerable to replay attacks when TLS is not used. This vulnerability is fixed in 0.8.1...

PT-2025-4303 · Unknown · Guzzle Oauth Subscriber

Name of the Vulnerable Software and Affected Versions: Guzzle OAuth Subscriber versions prior to 0.8.1 Description: The issue concerns the Guzzle OAuth Subscriber, which signs Guzzle requests using OAuth 1.0. Prior to version 0.8.1, the Nonce generation does not utilize sufficient entropy nor a...