Nonce generation does not use sufficient entropy nor a cryptographically secure pseudorandom source (https://github.com/guzzle/oauth-subscriber/blob/0.8.0/src/Oauth1.php#L192). This can leave servers vulnerable to replay attacks when TLS is not used.
Upgrade to version 0.8.1 or higher.
No.
Issue is similar to https://nvd.nist.gov/vuln/detail/CVE-2025-22376.
{ "nvd_published_at": "2025-01-06T20:15:39Z", "cwe_ids": [ "CWE-338" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2025-01-06T19:23:26Z" }