CVE-2025-40905

CVE-2025-40905: WWW::OAuth 1.000 and earlier for Perl uses insecure rand() function for cryptographic functions

Vendor Dbook

Product WWW::OAuth

Weakness CWE-338

Published February 12, 2026

Last update February 17, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

WWW::OAuth 1.000 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.

Key dates

02Disclosure timeline

February 12, 2026 CVE published

February 17, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-40905 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/338.html

Related vulnerabilities

04Related CVE

CVE-2026-8647 Crypt::ScryptKDF versions through 0.010 for Perl uses insecure random number source when no CSPRNG module is available CVE-2018-25107 CVE-2024-57835 Amon2::Auth::Site::LINE versions through 0.04 for Perl uses insecure rand() function for cryptographic functions CVE-2025-3495 COMMGR - Insufficient Randomization Authentication Bypass CVE-2024-40762