Guzzle OAuth Subscriber signs Guzzle requests using OAuth 1

CVE-2025-21617 is a low-entropy nonce bug in guzzlehttp/oauth-subscriber, the PHP middleware that signs Guzzle requests with OAuth 1.0. Affected versions are all releases before 0.8.1—practically the 0.1.0 through 0.8.0 line. Before the fix, the library generated oauth_nonce values predictably enough that a replay attack becomes more realistic if signed requests traverse the network without TLS protection.

In real enterprise conditions this is not a front-of-queue patch. The decisive friction is the attack precondition: the attacker typically needs on-path visibility or another way to capture OAuth 1.0 traffic *and* the deployment has to permit non-TLS transport or equivalent plaintext exposure on an internal segment. That sharply narrows the reachable population, so despite the security smell and the wide package install base, this lands as = ASSESSED AT LOW.

Why this verdict

• Requires plaintext or equivalent visibility: the advisory itself says replay risk materializes when TLS is not used, so secure transport removes most real-world exposure.
• Attacker position is unfavorable: practical abuse usually needs on-path access, implying internal foothold, proxy compromise, or another prior-stage win before this CVE matters.
• Blast radius is narrow: impact is limited to replaying the specific OAuth-signed action available to that client integration, not host takeover or broad tenant escape.

Why not higher?

This is not an unauthenticated internet-to-RCE story. To matter operationally, the deployment usually has to be using legacy OAuth 1.0, running a vulnerable dependency, and exposing signed traffic without proper TLS or equivalent confidentiality. Those are compounding friction points, not edge-case details.

Why not lower?

It is still a real security defect in a broadly used package, and some enterprises absolutely have internal HTTP hops, legacy API gateways, or test/prod exceptions that break the 'TLS everywhere' assumption. If the signed request performs a non-idempotent action, replay can become a legitimate business-risk issue rather than a paper cut.

1. Enforce TLS end to end — Make sure OAuth 1.0 requests are protected from client through every proxy hop to the API origin, not just at the internet edge. For a LOW verdict there is no formal noisgate mitigation SLA; treat this as backlog hygiene, but fix any plaintext exception immediately if you discover one because that is the real enabler.
2. Block cleartext egress for OAuth clients — Use proxy policy, service mesh policy, or firewall rules to prevent app tiers from sending OAuth 1.0 requests over plain HTTP. Again, LOW means no formal mitigation SLA, so fold this into routine network-hardening work unless you find an active non-TLS path.
3. Add replay rejection server-side — Where you own the receiving API, verify nonce uniqueness and timestamp windows tightly, and add idempotency controls for state-changing operations. Treat this as backlog hardening for low-severity exposure, especially on legacy integrations you cannot retire quickly.
4. Inventory and retire OAuth 1.0 usage — The best long-term control is reducing the population that still depends on OAuth 1.0 signing at all. Because the verdict is LOW, schedule this with normal architecture debt reduction rather than emergency response.

Run this on the application host, CI workspace, or any auditor workstation that can read the target project's composer.lock. Invoke it as python3 check_cve_2025_21617.py /path/to/app or point directly at the lockfile like python3 check_cve_2025_21617.py /var/www/html/composer.lock. It needs only read access; no admin privileges are required.

#!/usr/bin/env python3
# Check for CVE-2025-21617 in guzzlehttp/oauth-subscriber
# Usage: python3 check_cve_2025_21617.py /path/to/app-or-composer.lock
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import json
import os
import re
import sys

PACKAGE = 'guzzlehttp/oauth-subscriber'
FIXED = (0, 8, 1)


def normalize_version(v):
    if v is None:
        return None
    v = v.strip()
    if v.startswith('v'):
        v = v[1:]
    v = v.split('@', 1)[0]
    if any(tag in v.lower() for tag in ['dev', 'alpha', 'beta', 'rc', 'patch', 'pl']):
        # Composer branches / pre-release naming are ambiguous for this simple offline check
        return None
    m = re.match(r'^(\d+)\.(\d+)\.(\d+)(?:[.+-].*)?$', v)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def compare_version(a, b):
    return (a > b) - (a < b)


def load_lockfile(path):
    with open(path, 'r', encoding='utf-8') as f:
        return json.load(f)


def find_package(data, name):
    for section in ('packages', 'packages-dev'):
        for pkg in data.get(section, []) or []:
            if pkg.get('name') == name:
                return pkg
    return None


def resolve_target(arg):
    if os.path.isdir(arg):
        candidate = os.path.join(arg, 'composer.lock')
        if os.path.isfile(candidate):
            return candidate
        return None
    if os.path.isfile(arg) and os.path.basename(arg) == 'composer.lock':
        return arg
    return None


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python3 check_cve_2025_21617.py /path/to/app-or-composer.lock')
        sys.exit(2)

    target = resolve_target(sys.argv[1])
    if not target:
        print('UNKNOWN - composer.lock not found')
        sys.exit(2)

    try:
        data = load_lockfile(target)
    except Exception as e:
        print(f'UNKNOWN - failed to read lockfile: {e}')
        sys.exit(2)

    pkg = find_package(data, PACKAGE)
    if not pkg:
        print(f'UNKNOWN - package {PACKAGE} not present in lockfile')
        sys.exit(2)

    raw_version = pkg.get('version')
    parsed = normalize_version(raw_version)
    if parsed is None:
        print(f'UNKNOWN - package present but version is non-semver or ambiguous: {raw_version}')
        sys.exit(2)

    if compare_version(parsed, FIXED) < 0:
        print(f'VULNERABLE - {PACKAGE} {raw_version} < 0.8.1')
        sys.exit(1)

    print(f'PATCHED - {PACKAGE} {raw_version} >= 0.8.1')
    sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. GitHub Security Advisory GHSA-237r-r8m4-4q88
2. Fix commit 92b619b
3. Release 0.8.1
4. NVD entry for CVE-2025-21617
5. OSV entry for CVE-2025-21617
6. Packagist package metadata
7. GitLab Advisory Database entry