CVE-2026-13082

GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets. The random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a (by default) six-character string. The built-in rand function is unsuitable for security applications because it is predictable and reversible.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://security.metacpan.org/patches/G/GD-SecurityImage/1.75/CVE-2026-13082-r1.patch
https://www.cve.org/CVERecord?id=CVE-2025-40916

Configurations

No configuration.

History

24 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de GD::SecurityImage hasta la 1.75 para Perl usan rand para generar secretos. El método aleatorio crea el texto de desafío usado para el CAPTCHA muestreando caracteres de un array usando la función rand incorporada de Perl, y genera una cadena (por defecto) de seis caracteres. La función rand incorporada no es adecuada para aplicaciones de seguridad porque es predecible y reversible.

Information

Published : 2026-07-17 13:17

Updated : 2026-10-24 20:10

NVD link : CVE-2026-13082

Mitre link : CVE-2026-13082

CVE.ORG link : CVE-2026-13082

JSON object : View

Products Affected

No product.

CWE

CWE-338

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

CWE-804

Guessable CAPTCHA

{"id": "CVE-2026-13082", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13082", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-17T17:29:10.397745Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/burak/CPAN-GD-SecurityImage", "vendor": "BURAK", "product": "GD::SecurityImage", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.75"}], "packageName": "GD-SecurityImage", "programFiles": ["lib/GD/SecurityImage.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "GD::SecurityImage::random"}, {"name": "GD::SecurityImage::random_angle"}, {"name": "GD::SecurityImage::particle"}]}]}], "published": "2026-07-17T13:17:55.443", "references": [{"url": "https://security.metacpan.org/patches/G/GD-SecurityImage/1.75/CVE-2026-13082-r1.patch", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2025-40916", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-338"}, {"lang": "en", "value": "CWE-804"}]}], "descriptions": [{"lang": "en", "value": "GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets.\n\nThe random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a (by default) six-character string.\n\nThe built-in rand function is unsuitable for security applications because it is predictable and reversible."}, {"lang": "es", "value": "Las versiones de GD::SecurityImage hasta la 1.75 para Perl usan rand para generar secretos.\n\nEl m\u00e9todo aleatorio crea el texto de desaf\u00edo usado para el CAPTCHA muestreando caracteres de un array usando la funci\u00f3n rand incorporada de Perl, y genera una cadena (por defecto) de seis caracteres.\n\nLa funci\u00f3n rand incorporada no es adecuada para aplicaciones de seguridad porque es predecible y reversible."}], "lastModified": "2026-10-24T20:10:00.137", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}