CVE-2026-5084
WebDyne::Session versions before 3.003_704 for Perl generate the session id insecurely
- Published
- Updated
- Reserved
- Assigned by
- CPANSec
Description
WebDyne::Session versions before 3.003_704 for Perl generate the session id insecurely. The session handler generates the session id from an MD5 hash seeded with a call to the built-in rand() function. The rand function is passed a maximum value based on the process id, the epoch time and the reference address of the object, but this information will have no effect on the overall quality of the seed of the message digest. The rand function is seeded by 32-bits and is predictable. It is considered unsuitable for cryptographic purposes. Predictable session ids could allow an attacker to gain access to systems. Note that WebDyne::Session versions 1.042 and earlier appear to be in separate distributions from WebDyne.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CISA-ADPADP (enrichment) | 3.1 | Medium6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
| NVDNVD · Deferred | 3.1 | Medium6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
- EPSS (exploitation in 30 days)
- 0.33% · top 74% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.
Weakness
Affected products
- affected < 3.003_704
What to do
Solution: Upgrade to version 3.003_704 or later.
References (5)
- https://metacpan.org/release/ASPEER/WebDyne-2.075/source/lib/WebDyne/Session.pm#L120 (opens in a new tab)
- https://github.com/aspeer/WebDyne/commit/7a3f949dc24e62a276eb0db629db64aca356e954.patch (opens in a new tab)patch
- https://webdyne.org (opens in a new tab)
- https://security.metacpan.org/docs/guides/random-data-for-security.html (opens in a new tab)technical-description
- http://www.openwall.com/lists/oss-security/2026/05/11/3 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-5084)Record last updated .