CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2025-21617: Guzzle OAuth Subscriber has insufficient nonce entropy
6.3
CVSS
Description
Guzzle OAuth Subscriber signs Guzzle requests using OAuth 1.0. Prior to 0.8.1, Nonce generation does not use sufficient entropy nor a cryptographically secure pseudorandom source. This can leave servers vulnerable to replay attacks when TLS is not used. This vulnerability is fixed in 0.8.1.
Classification
CVE ID: CVE-2025-21617
CVSS Base Severity: MEDIUM
CVSS Base Score: 6.3
Affected Products
Vendor: guzzle
Product: oauth-subscriber
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.05% (probability of being exploited)
EPSS Percentile: 17.83% (scored less or equal to compared to others)
EPSS Date: 2025-02-04 (when was this score calculated)
References
https://github.com/guzzle/oauth-subscriber/security/advisories/GHSA-237r-r8m4-4q88https://github.com/guzzle/oauth-subscriber/commit/92b619b03bd21396e51c62e6bce83467d2ce8f53
https://github.com/guzzle/oauth-subscriber/blob/0.8.0/src/Oauth1.php#L192
https://github.com/guzzle/oauth-subscriber/releases/tag/0.8.1