CVE-2026-11832 describes a cryptographic weakness in Dancer2::Plugin::Auth::OAuth versions prior to 0.22. The plugin generates a nonce using an MD5 hash of the epoch time, which is predictable and thus considered a weak pseudo-random number generator (CWE-338). This predictability can allow attackers to guess or reproduce nonce values, potentially compromising OAuth authentication flows. The vulnerability has a CVSS 3.1 base score of 9.1 (critical), reflecting its network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality and integrity. No patch or official fix is documented at this time.

The use of a predictable nonce compromises the security of OAuth authentication by allowing attackers to potentially predict or reproduce nonce values. This can lead to unauthorized access or token forgery, impacting confidentiality and integrity of the authentication process. Availability is not affected. The vulnerability is exploitable remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing custom nonce generation using a cryptographically secure random number generator or upgrading to version 0.22 or later once available.