CVE-2026-5083 Details
Description
Ado::Sessions versions through 0.935 for Perl generates insecure session ids. The session id is generated from a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems. Note that Ado is no longer maintained, and has been removed from the CPAN index. It is still available on BackPAN.
A vulnerability exists in Ado::Sessions versions through 0.935 for Perl, where session IDs are generated in an insecure manner. The session ID creation process uses a SHA-1 hash that is seeded with the built-in rand function, the epoch time, and the process ID (PID). This method is problematic because the PID is drawn from a limited range of values, and the epoch time can be predicted unless it is disclosed in the HTTP Date header. The use of the rand function, which is not suitable for cryptographic purposes, leads to predictable session IDs. Such predictability could allow an attacker to hijack sessions and gain unauthorized access to systems.
Users are advised to switch to a maintained alternative that generates session IDs using a secure random number generator. Recommendations for secure random data generation in Perl include using the Crypt::URandom, Crypt::SysRandom, or Sys::GetRandom modules.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://backpan.perl.org/authors/id/B/BE/BEROV/Ado-0.935.tar.gz | CPANSec | Product |
| https://github.com/kberov/Ado/issues/112 | CPANSec | Issue Tracking |
| https://security.metacpan.org/docs/guides/random-data-for-security.html | CPANSec | Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2026/04/08/7 | CVE | Mailing List |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | CPANSec |
| CWE-340 | Generation of Predictable Numbers or Identifiers | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| berov ado::sessions | <= 0.935 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 23, 2026 | Initial Analysis | [email protected] |
| Apr 8, 2026 | CVE Modified | CVE |
| Apr 8, 2026 | CVE Modified | CISA-ADP |
| Apr 8, 2026 | New CVE Received | CPANSec |