Loading story…
Two Perl distributions, Ado::Sessions and Solstice::Session, were disclosed with vulnerabilities that generate session identifiers from weak, predictable inputs, creating a risk of session prediction and unauthorized access. In CVE-2026-5083, Ado::Sessions through version 0.935 uses a SHA-1 hash seeded with Perl rand, epoch time, and process ID; in CVE-2026-5085, Solstice::Session through version 1440 uses an MD5 digest built from epoch time, a stringified hash reference, Perl rand(), and process ID, with the same pattern also affecting Solstice::Subsession via _generateID.
Both flaws were classified under CWE-340 and CWE-338, reflecting predictable values and insufficient entropy in security-sensitive randomness. The disclosures warn that attackers may be able to infer or guess the underlying inputs—particularly time and PID values—and derive valid session tokens to hijack active sessions. The Ado issue is compounded by the project’s abandoned status: the distribution is no longer maintained, has been removed from the CPAN index, and remains available only on BackPAN.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
The CPAN Security Group disclosed CVE-2026-5084 on oss-sec, affecting WebDyne::Session through version 2.075 due to predictable session ID generation based on an MD5 hash seeded with Perl's rand() and related weak inputs. The advisory warned that attackers could potentially predict session identifiers and gain unauthorized access to affected systems.
The CPAN Security Group disclosed CVE-2026-5085 on oss-sec, affecting Solstice::Session through version 1440 and Solstice::Subsession due to predictable session ID generation using weak inputs such as time, rand(), and PID.
A notice was issued stating that the Ado project would no longer receive updates. The advisory later notes the project is unmaintained and removed from the CPAN index.
The last Ado release on CPAN, version 0.935, was published. This version is later identified as affected by insecure session ID generation in Ado::Sessions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourcecvefeed.io
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability, **CVE-2026-13577**, was disclosed in **Dancer2** for Perl that can cause applications to generate predictable session IDs when cryptographically secure random number generator modules are unavailable. The issue affects Dancer2 versions through `2.1.0` and stems from `Dancer2::Core::Role::SessionFactory::generate_id` silently falling back to a session identifier derived from Perl’s built-in `rand()` and other low-entropy values instead of a secure source of randomness. Because Perl’s `rand()` is not suitable for security-sensitive use and may be seeded with only 32 bits, attackers could guess valid session identifiers and gain unauthorized access to user sessions. The flaw is rated **CVSS 8.2** and mapped to **CWE-338** and **CWE-340**. Maintainers recommend upgrading to **Dancer2 2.1.1 or later** and ensuring `Math::Random::ISAAC::XS` or `Crypt::URandom` is installed and available in the application’s `PERL5LIB` path to prevent the insecure fallback.
Jul 20, 2026
A high-severity vulnerability, **CVE-2026-16235**, was disclosed in DRSTEVE's Perl module **`Crypt::Password`**, where versions through **0.28** generate password salts using Perl's built-in **`rand`** function. Because `rand` is predictable and not suitable for cryptographic use, the issue was classified as **CWE-338** and assigned a **CVSS v3.1** score with vector **`AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`**, indicating potentially severe impact if affected applications rely on the module for password handling. The disclosure said there is **no known exploitation** so far, but exploitation would be **automatable** and could have **total technical impact**. Maintainers and users were advised to avoid the module's default salt generation by supplying salts generated with a stronger source such as **`Crypt::URandom::Token`**, and to consider migrating away from `Crypt::Password` entirely because the package reportedly has not been updated since **2012**.
Jul 20, 2026
`CVE-2026-5088` affects `Apache::API::Password` in the `Apache2-API` Perl distribution through version `0.5.2`, where password salt generation can fall back to Perl’s built-in `rand` function if `Crypt::URandom` or `Bytes::Random::Secure` is unavailable. The vulnerable `_make_salt` and `_make_salt_bcrypt` methods may therefore produce weak, predictable salt values for password hashing, exposing deployments to reduced password protection and fitting `CWE-338`, use of a cryptographically weak pseudo-random number generator. The issue was disclosed by the CPAN Security Group, and maintainer Jacques Deguest said it was fixed in version `0.5.3`, which was released to CPAN. Organizations using the module are advised to upgrade to `0.5.3` or later and ensure `Crypt::URandom` is installed to prevent insecure fallback behavior during salt generation.
Jun 29, 2026