Dancer2::Plugin::Auth::OAuth generates a nonce by hashing the current epoch time with MD5, producing a value that is fully predictable. Because the OAuth workflow treats this nonce as a security token, an attacker who can anticipate its value can replay authentication requests or forge legitimate sessions, effectively bypassing authentication controls. The weakness aligns with cryptographic algorithm specification errors, identified as CWE‑338.

The vulnerability affects the Perl module Dancer2::Plugin::Auth::OAuth in any installation that uses a version earlier than 0.22. These versions are maintained by the BIAFRA vendor. The issue exists in all builds of the plugin that rely on the default nonce logic, regardless of the host application.

The CVSS score of 9.1 marks this flaw as critical, indicating a high potential for exploitation. The EPSS score of less than 1% suggests that, despite the severity, the actual exploitation likelihood is low at present, and the vulnerability is not catalogued in the CISA KEV list. Attackers would need to interact with an OAuth transaction involving the vulnerable plugin, and could exploit the predictable nonce to craft a request that the server accepts, thereby gaining unauthorized access.