CVE-2026-2439 Details
Description
Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids. The generate_session_id function in Concierge::Sessions::Base defaults to using the uuidgen command to generate a UUID, with a fallback to using Perl's built-in rand function. Neither of these methods are secure, and attackers are able to guess session_ids that can grant them access to systems. Specifically, * There is no warning when uuidgen fails. The software can be quietly using the fallback rand() function with no warnings if the command fails for any reason. * The uuidgen command will generate a time-based UUID if the system does not have a high-quality random number source, because the call does not explicitly specify the --random option. Note that the system time is shared in HTTP responses. * UUIDs are identifiers whose mere possession grants access, as per RFC 9562. * The output of the built-in rand() function is predictable and unsuitable for security applications.
A vulnerability exists in Concierge::Sessions versions 0.8.1 prior to 0.8.5 for Perl, where the session IDs generated are insecure. The issue arises because the default method for creating session IDs relies on the uuidgen command, which can produce time-based UUIDs if the system lacks a reliable source of randomness. This vulnerability is exacerbated by the absence of error handling when uuidgen fails, leaving the predictable rand() function as a fallback. As a result, attackers can guess session IDs and gain unauthorized access. The vulnerability is present in the session management system, specifically within the session ID generation process.
Users can upgrade to Concierge::Sessions version 0.8.5 or later, where this vulnerability has been addressed. The insecure session ID generation has been replaced with a method that uses Crypt::URandom to create cryptographically secure random IDs. Instructions for updating can be found in the 'Changes' section of the release notes.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/bwva/Concierge-Sessions/commit/20bb28e92e8fba307c4ff8264701c215be65e73b | CPANSec | Patch |
| https://metacpan.org/release/BVA/Concierge-Sessions-v0.8.4/diff/BVA/Concierge-Sessions-v0.8.5#lib/Concierge/Sessions/Base.pm | CPANSec | ProductRelease Notes |
| https://perldoc.perl.org/5.42.0/functions/rand | CPANSec | Third Party Advisory |
| https://security.metacpan.org/docs/guides/random-data-for-security.html | CPANSec | Third Party Advisory |
| https://www.rfc-editor.org/rfc/rfc9562.html#name-security-considerations | CPANSec | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | CPANSec |
| CWE-340 | Generation of Predictable Numbers or Identifiers | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| bva concierge::sessions | >= 0.8.1, < 0.8.5 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 10, 2026 | Initial Analysis | [email protected] |
| Feb 17, 2026 | CVE Modified | CISA-ADP |
| Feb 16, 2026 | New CVE Received | CPANSec |