CVE-2025-21617: Guzzle OAuth Subscriber Insufficient Nonce Entropy Vulnerability
Summary
CVE-2025-21617: Guzzle OAuth Subscriber has insufficient nonce entropy. Affects guzzlehttp/oauth-subscriber versions < 0.8.1. Fixed in 0.8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Guzzle OAuth Subscriber is a PHP library that provides OAuth 1.0a authentication for Guzzle, a popular HTTP client. It simplifies the process of making authenticated requests to APIs that require OAuth. However, the library has a vulnerability related to nonce generation, which is crucial for preventing replay attacks. This vulnerability arises from the use of insufficient entropy in nonce generation, making it easier for attackers to exploit the system, especially when TLS is not in use.
Vulnerability Detail
The vulnerability stems from the nonce generation mechanism in the Guzzle OAuth Subscriber, which does not utilize sufficient entropy or a cryptographically secure pseudorandom source. This flaw can lead to replay attacks, where an attacker could potentially reuse valid requests to gain unauthorized access or perform actions on behalf of a user. The specific line of code responsible for this issue can be found in the Oauth1.php file of the library. Without proper nonce generation, the integrity and security of the requests are compromised.
How To Fix
Minimum fixed version
0.8.1
This is the first release that contains the fix.
composer require guzzlehttp/oauth-subscriber:0.8.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. The best course of action is to upgrade to the patched version as mentioned above.
Conclusion
The Guzzle OAuth Subscriber vulnerability (CVE-2025-21617) highlights the importance of secure nonce generation in OAuth implementations. By upgrading to version 0.8.1 or higher, developers can protect their applications from potential replay attacks. Continuous monitoring for vulnerabilities, such as through Vulert, is also recommended to maintain application security.
See every vulnerability recorded for guzzlehttp/oauth-subscriber →
FAQ
A nonce is a unique, random string that is used to ensure that each request is unique and cannot be reused. It helps prevent replay attacks.
If your application uses Guzzle OAuth Subscriber without the patch, it may be susceptible to replay attacks, especially if TLS is not implemented.
No, using older versions that are vulnerable to this issue poses a security risk. It is essential to upgrade to the latest version.
While there are no workarounds, you should prioritize upgrading as soon as possible to mitigate the risk of replay attacks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just the composer.lock file. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
