CVE-2026-46473 Details
Description
Authen::TOTP versions before 0.1.1 for Perl generate secrets using rand. Secrets were generated using Perl's built-in rand function, which is predictable and unsuitable for security usage.
A vulnerability exists in Authen::TOTP versions prior to 0.1.1 for Perl, where the generation of secret keys relied on Perl's built-in rand function. This method is predictable and not suitable for secure applications. The vulnerability has been addressed in version 0.1.1, which replaces the random key generation with a more secure alternative from the Crypt::PRNG module.
Users can upgrade to Authen::TOTP version 0.1.1, which is available on CPAN. This version replaces the insecure random number generation with a method from the Crypt::PRNG module, ensuring that secret keys are generated securely.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 21, 2026CISA-ADP
Assessed May 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tchatzi/Authen-TOTP/commit/d04f30cc6538d77fc6b6d550da450cf3017b8561.patch | CPANSec | Source CodeVendor |
| https://metacpan.org/release/TCHATZI/Authen-TOTP-0.1.1/changes | CPANSec | Vendor |
| http://www.openwall.com/lists/oss-security/2026/05/21/15 | CVE |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-331 | Insufficient Entropy | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| Authen::TOTP | < 0.1.1 (semver) |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 21, 2026 | CVE Modified | CVE |
| May 21, 2026 | CVE Modified | CISA-ADP |
| May 21, 2026 | New CVE Received | CPANSec |