Guzzle OAuth Subscriber signs Guzzle requests using OAuth 1.0. Prior to 0.8.1, Nonce generation does not use sufficient entropy nor a cryptographically secure pseudorandom source. This can leave servers vulnerable to replay attacks when TLS is not used. This vulnerability is fixed in 0.8.1.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| guzzlehttp/oauth-subscriber(Packagist) | 0 | 0.8.1 | N/A |
CVSS Metrics
