VULNERABILITY INTELLIGENCE
CVE-2026-9692
CVSS score5.3 MEDIUM
EPSS probability0.42%
CISA KEVNot currently listed
Published2026-06-18
Last modified2026-10-26
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Description
Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, the heap address of an anonymous hash, and the PID. These are predictable or low-entropy sources that are unsuitable for security purposes.
Weakness classification
- 9b29abf9-4ab0-4765-b253-1875cd9b441e: CWE-338