CVE-2026-46474 Details
Description
Trog::TOTP versions before 1.006 for Perl generate secrets using rand. Secrets were generated using Perl's built-in rand function, which is predictable and unsuitable for security usage.
A vulnerability exists in Trog::TOTP versions prior to 1.006 for Perl, where the library generates secrets using the built-in rand function. This method of random number generation is predictable and not suitable for secure applications. The issue has been addressed in version 1.006, which replaces the built-in rand with Crypt::PRNG::rand, a more secure alternative.
Users can upgrade to Trog::TOTP version 1.006 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 15, 2026CISA-ADP
Assessed May 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://metacpan.org/release/TEODESIAN/Trog-TOTP-1.006/changes | CPANSec | Vendor |
| https://metacpan.org/release/TEODESIAN/Trog-TOTP-1.006/diff/TEODESIAN/Trog-TOTP-1.005#lib/Trog/TOTP.pm | CPANSec | Source CodeVendor |
| http://www.openwall.com/lists/oss-security/2026/05/15/18 | CVE |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-331 | Insufficient Entropy | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| Trog::TOTP | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 18, 2026 | CVE Modified | CISA-ADP |
| May 15, 2026 | CVE Modified | CVE |
| May 15, 2026 | New CVE Received | CPANSec |