Guzzle Oauth Subscriber vulnerabilities

1 vulnerability

Known vulnerabilities in Guzzle Oauth Subscriber, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.3CVE-2025-21617guzzleoauth-subscriber
EPSS score
0.48%
Guzzle OAuth Subscriber signs Guzzle requests using OAuth 1.0. Prior to 0.8.1, Nonce generation does not use sufficient entropy nor a cryptographically secure pseudorandom source. This can leave servers vulnerable to replay attacks when TLS is not used. This vulnerability is fixed in 0.8.1.