CVE-2025-21617: Guzzle OAuth Subscriber has insufficient nonce entropy

medium Affects guzzlehttp/oauth-subscriber. Feed 2026.10.29.4, updated 2026-10-29; published 2025-01-06; advisory modified 2026-07-15.

Guzzle OAuth Subscriber has insufficient nonce entropy

Package: guzzlehttp/oauth-subscriber Composer
Affected versions: <0.8.1
Fixed in: 0.8.1
Severity: medium
Exploitation: not on CISA KEV · EPSS 0% (41.3th percentile)
Published: 2025-01-06
Source: osv.dev

References

CWE-338

NVD record guzzlehttp/oauth-subscriber advisories

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden deps composer.lock

# or, without Composer
pipx install phpwarden   &&   phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs How findings are ranked

Related advisories

CVE-2017-5493 high wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does same weakness: CWE-338
CVE-2015-9435 critical The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random n same weakness: CWE-338
CVE-2021-3692 medium Use of Cryptographically Weak Pseudo-Random Number Generator in yiisoft/yii2-dev same weakness: CWE-338
CVE-2022-0828 high The Download Manager WordPress plugin before 3.2.34 uses the uniqid php function to genera same weakness: CWE-338
CVE-2019-7860 high Magento 2 Community Edition Weak PRNG same weakness: CWE-338
CVE-2021-3678 medium Use of Cryptographically Weak Pseudo-Random Number Generator in showdoc same weakness: CWE-338