CVE-2026-9733 -- CVSS 9.1 Vulnerability Briefing

CVE-2026-9733 | CVSS 9.1 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-9733 is an insecure default vulnerability in the OAuth2 state parameter handling within the Perl module Mojolicious::Plugin::Web::Auth::OAuth2, affecting versions through 0.17, which exposes web applications using this plugin to cross-site request forgery (CSRF) attacks against OAuth2 authorization flows.

Technical Detail

The flaw exists because when no custom state generator is provided to the module constructor, the plugin falls back to an insecure default state value rather than generating a cryptographically random, unpredictable token. The OAuth2 state parameter is a CSRF protection mechanism; a predictable or static state value allows an attacker to craft a malicious authorization callback that a victim's browser will accept as legitimate, enabling the attacker to bind their own OAuth2 authorization code to the victim's session. Successful exploitation results in account takeover or unauthorized access to resources protected by the OAuth2 flow.

Exploitation Status

No known exploit exists for this vulnerability at this time. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog. The exploit maturity is currently assessed as no known exploit, meaning no public proof-of-concept or observed in-the-wild exploitation has been confirmed as of June 30, 2026.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor activity has been associated with this vulnerability.

What To Do

Operators using Mojolicious::Plugin::Web::Auth::OAuth2 should upgrade to a patched version of the module beyond 0.17 as soon as one is available from the upstream maintainer; check CPAN for the latest release. As an immediate workaround, explicitly configure a cryptographically secure state generator in the plugin constructor rather than relying on the default behavior, using a function that produces a sufficiently random, unguessable token per session. Review application logs for anomalous OAuth2 callback requests where the state parameter is absent, static, or does not match a value issued by the server. Given the CVSS score of 9.1, treat this as a high-priority remediation even in the absence of confirmed active exploitation.