CVE-2026-5084 Details
Description
WebDyne::Session versions before 3.003_704 for Perl generate the session id insecurely. The session handler generates the session id from an MD5 hash seeded with a call to the built-in rand() function. The rand function is passed a maximum value based on the process id, the epoch time and the reference address of the object, but this information will have no effect on the overall quality of the seed of the message digest. The rand function is seeded by 32-bits and is predictable. It is considered unsuitable for cryptographic purposes. Predictable session ids could allow an attacker to gain access to systems. Note that WebDyne::Session versions 1.042 and earlier appear to be in separate distributions from WebDyne.
A vulnerability exists in WebDyne::Session for Perl, in versions through 2.075, due to the session ID being generated insecurely. The session handler creates the session ID using an MD5 hash that is seeded with a predictable value from the built-in rand() function. This seeding is based on the process ID, epoch time, and the reference address of the object, but does not enhance the randomness for cryptographic use. The predictable session IDs could potentially allow an attacker to gain unauthorized access to systems.
Users can upgrade to WebDyne::Session version 2.075 or later, where this vulnerability is addressed. When generating session IDs, it is recommended to use a secure random number generator, such as those provided by the Crypt::URandom or Crypt::OpenSSL modules.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 11, 2026CISA-ADP
Assessed May 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | CPANSec |
| CWE-340 | Generation of Predictable Numbers or Identifiers | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| WebDyne::Session | All versions |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 2, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | CVE Modified | CVE |
| May 11, 2026 | New CVE Received | CPANSec |