Guzzle OAuth Subscriber Insufficient Nonce Entropy Vulnerability Allowing Replay Attacks

A vulnerability exists in Guzzle OAuth Subscriber versions prior to 0.8.1, where the OAuth 1.0 nonce generation lacks adequate entropy and does not utilize a cryptographically secure pseudorandom source. This deficiency can expose servers to replay attacks, particularly when TLS is not implemented.

Impact

The flawed nonce generation can lead to replay attacks on servers, allowing an attacker to impersonate a user by resending requests that include the OAuth signature.

Remediation

Users are advised to upgrade to Guzzle OAuth Subscriber version 0.8.1 or later.