HAYAJO vulnerabilities

🔔 Create alert RSS

Published CVEs affecting HAYAJO products: 2 record(s), with severity, exploitation and fixes.

Mojolicious::Plugin::Web::Auth::OAuth2 1 Mojolicious::Sessions::Storable 1

Exploited only (KEV) →

CVE-2026-9733 Critical · 9.1 CWE-338 Jun 23, 2026

Mojolicious OAuth2 Plugin for Perl: Predictable Default State Parameter (CWE-338)

Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter. When no state generator is specified in the constructor, the module defaults to using a SHA-1 hash of predictable and low-entropy sources, including the epoch time (which is leaked via the HTTP Date header) and a call to Perl's built-in rand function. A predictable state allows an attacker to hijack another user's session through cross site request forgery (CSRF).

CVE-2026-9692 Medium · 5.3 CWE-338 Jun 18, 2026

Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely

Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, the heap address of an anonymous hash, and the PID. These are predictable or low-entropy sources that are unsuitable for security purposes.