VULNERABILITY INTELLIGENCE

CVE-2025-21617

EPSS probability0.48%
CISA KEVNot currently listed
Published2025-01-06
Last modified2026-06-17

Description

Guzzle OAuth Subscriber signs Guzzle requests using OAuth 1.0. Prior to 0.8.1, Nonce generation does not use sufficient entropy nor a cryptographically secure pseudorandom source. This can leave servers vulnerable to replay attacks when TLS is not used. This vulnerability is fixed in 0.8.1.

Weakness classification

  • security-advisories@github.com: CWE-338

Primary references