CVE-2025-40905: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-40905 is a cryptographic weakness vulnerability in the WWW::OAuth Perl module (versions 1.000 and earlier) that uses Perl's built-in rand() function as the default source of entropy for cryptographic operations. Because rand() is not cryptographically secure, generated nonces and other OAuth-related random values are predictable. The vulnerability was disclosed on February 13, 2026, via the oss-security mailing list and the CPAN Security Group. It carries a CVSS v3.1 base score of 7.3 (High) (Red Hat Advisory, oss-security).

The root cause is classified as CWE-338 (Use of Cryptographically Weak Pseudo-Random Number Generator). Specifically, WWW::OAuth version 1.000 and earlier defaults to Perl's rand() function at line 86 of lib/WWW/OAuth.pm when generating random values required for OAuth 1.0 cryptographic operations (e.g., nonce generation). Because rand() is a linear congruential PRNG seeded with predictable values, an attacker who can observe sufficient OAuth nonces may be able to predict future nonces, potentially forging or replaying OAuth-signed requests. The attack vector is network-accessible and requires no authentication or user interaction (oss-security, CPAN Security).

Successful exploitation could allow an attacker to predict OAuth nonces generated by the affected library, undermining the integrity and confidentiality of OAuth 1.0 signed requests. This may enable nonce prediction attacks, request forgery, or replay attacks against services relying on WWW::OAuth for authentication, resulting in low-level confidentiality, integrity, and availability impacts as reflected in the CVSS scoring. Applications using this module to authenticate API calls on behalf of users are at risk of having those sessions compromised (Red Hat Advisory, oss-security).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-40905. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation would require an attacker to observe multiple OAuth nonces to reconstruct the PRNG state, which adds practical complexity (Red Hat Advisory).

The CPAN Security Group recommends upgrading WWW::OAuth to version 1.001 or higher, which replaces the insecure rand() call with a cryptographically secure entropy source. Administrators can update via CPAN: cpan install WWW::OAuth or cpanm WWW::OAuth. No configuration-based workaround is available for the vulnerable versions; upgrading is the only remediation (oss-security).

The vulnerability was reported to the oss-security mailing list by Alan Coopersmith (Oracle) on February 13, 2026, crediting Robert Rothenberg (RRWO) as the finder. Red Hat tracked the issue and published a security advisory. A Bluesky post from the infosec community noted the disclosure shortly after publication. Overall community reaction has been low-key given the limited scope of the affected library (oss-security, Red Hat Advisory).