CVE-2026-13577

Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function). These are all low-entropy and easily guessed sources. The built-in rand() function is seeded with 32-bits and considered unsuitable for security applications. Predictable session ids could allow an attacker to gain access to systems.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/PerlDancer/Dancer2/blob/v2.1.0/lib/Dancer2/Core/Role/SessionFactory.pm#L142
https://github.com/PerlDancer/Dancer2/issues/1807
https://github.com/PerlDancer/Dancer2/pull/1804
https://metacpan.org/release/CROMEDOME/Dancer2-2.2.0/changes
https://www.cve.org/CVERecord?id=CVE-2026-5080

Configurations

No configuration.

History

24 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de Dancer2 hasta la 2.1.0 para Perl generan identificadores de sesión inseguros cuando los módulos CSPRNG requeridos no están disponibles. Dancer2::Core::Role::SessionFactory::generate_id recurre silenciosamente a un identificador de sesión derivado de la función ’rand’ incorporada a menos que Math::Random::ISAAC::XS y Crypt::URandom estén ambos disponibles. El identificador de sesión de respaldo se genera a partir de un hash SHA-1 de una llamada a la función ’rand’ incorporada, la ruta absoluta del módulo Dancer2::Core::Role::SessionFactory, un contador interno, el ID del proceso, la dirección de memoria de la instancia del módulo y una cadena de caracteres mezclada (utilizando la función List::Util::shuffle, que también usa la función ’rand’ incorporada). Todas estas son fuentes de baja entropía y fácilmente predecibles. La función ’rand()’ incorporada se inicializa con 32 bits y se considera inadecuada para aplicaciones de seguridad. Los identificadores de sesión predecibles podrían permitir a un atacante obtener acceso a los sistemas.

20 Sep 2026, 11:16

Type	Values Removed	Values Added
References		() https://github.com/PerlDancer/Dancer2/issues/1807 - () https://github.com/PerlDancer/Dancer2/pull/1804 - () https://metacpan.org/release/CROMEDOME/Dancer2-2.2.0/changes -
Summary	(en) Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function). These are all low-entropy and easily guessed sources. The built-in rand() function is seeded with 32-bits and considered unsuitable for security applications. Predictable session ids could allow an attacker to gain access to systems.	(en) Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function). These are all low-entropy and easily guessed sources. The built-in rand() function is seeded with 32-bits and considered unsuitable for security applications. Predictable session ids could allow an attacker to gain access to systems.

Information

Published : 2026-07-20 08:16

Updated : 2026-10-24 20:10

NVD link : CVE-2026-13577

Mitre link : CVE-2026-13577

CVE.ORG link : CVE-2026-13577

JSON object : View

Products Affected

No product.

CWE

CWE-338

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

CWE-340

Generation of Predictable Numbers or Identifiers

8.2 /10