CVE-2026-5082 Details
Description
Amon2::Plugin::Web::CSRFDefender versions from 7.00 through 7.03 for Perl generate an insecure session id. The generate_session_id function will attempt to read bytes from the /dev/urandom device, but if that is unavailable then it generates bytes using SHA-1 hash seeded with the built-in rand() function, the PID, and the high resolution epoch time. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Amon2::Plugin::Web::CSRFDefender versions before 7.00 were part of Amon2, which was vulnerable to insecure session ids due to CVE-2025-15604. Note that the author has deprecated this module.
A vulnerability exists in Amon2::Plugin::Web::CSRFDefender versions 7.00 through 7.03 for Perl, where the session ID generation is insecure. The 'generate_session_id' function attempts to read bytes from '/dev/urandom'. If this is unavailable, it falls back to a method using the SHA-1 hash, seeded with the built-in rand() function, the process ID (PID), and the high-resolution epoch time. This fallback method is cryptographically weak, as the PID is drawn from a limited range of values and the epoch time can be estimated unless the HTTP Date header reveals it. Versions prior to 7.00 also had this vulnerability, but it was due to a different implementation that relied on the rand() function to create session IDs.
Users are advised to update to Amon2::Plugin::Web::CSRFDefender version 7.04 or later, where this vulnerability has been addressed by using a more secure method for random number generation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://metacpan.org/release/TOKUHIROM/Amon2-Plugin-Web-CSRFDefender-7.03/source/lib/Amon2/Plugin/Web/CSRFDefender/Random.pm | CPANSec | Product |
| https://metacpan.org/release/TOKUHIROM/Amon2-Plugin-Web-CSRFDefender-7.04/changes | CPANSec | Release Notes |
| https://www.cve.org/CVERecord?id=CVE-2025-15604 | CPANSec | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | CPANSec |
| CWE-340 | Generation of Predictable Numbers or Identifiers | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| tokuhirom amon2::plugin::web::csrfdefender | >= 7.00, <= 7.03 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 23, 2026 | Initial Analysis | [email protected] |
| Apr 8, 2026 | CVE Modified | CISA-ADP |
| Apr 8, 2026 | New CVE Received | CPANSec |