CVE-2026-5088

Apache::API::Password versions through 0.5.2 for Perl can generate insecure random values for salts. The _make_salt and _make_salt_bcrypt methods will attept to load Crypt::URandom and then Bytes::Random::Secure to generate random bytes for the salt. If those modules are unavailable, it will simply return 16 bytes generated with Perl's built-in rand function. The rand function is unsuitable for cryptographic use. These salts are used for password hashing.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://metacpan.org/pod/Crypt::URandom	Product
https://metacpan.org/release/JDEGUEST/Apache2-API-v0.5.2/view/lib/Apache2/API/Password.pod	Product
https://metacpan.org/release/JDEGUEST/Apache2-API-v0.5.3/changes	Release Notes
https://security.metacpan.org/docs/guides/random-data-for-security.html	Product
http://www.openwall.com/lists/oss-security/2026/04/15/4	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/04/15/5	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:jdeguest:apache\:\:api\:\:password:*:*:*:*:*:perl:*:*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de Apache::API::Password hasta la 0.5.2 para Perl pueden generar valores aleatorios inseguros para las sales. Los métodos _make_salt y _make_salt_bcrypt intentarán cargar Crypt::URandom y luego Bytes::Random::Secure para generar bytes aleatorios para la sal. Si esos módulos no están disponibles, simplemente devolverá 16 bytes generados con la función rand incorporada de Perl. La función rand no es adecuada para uso criptográfico. Estas sales se utilizan para el hash de contraseñas.

Information

Published : 2026-04-15 08:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-5088

Mitre link : CVE-2026-5088

CVE.ORG link : CVE-2026-5088

JSON object : View

Products Affected

jdeguest

apache\

CWE

CWE-338

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

{"id": "CVE-2026-5088", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5088", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-16T11:59:31.300289Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://gitlab.com/jackdeguest/Apache2-API", "vendor": "JDEGUEST", "product": "Apache::API::Password", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "0.5.2"}], "packageName": "Apache2-API", "programFiles": ["lib/Apache2/API.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Apache2::API::Password::_make_salt"}, {"name": "Apache2::API::Password::_make_salt_bcrypt"}]}]}], "published": "2026-04-15T08:16:16.790", "references": [{"url": "https://metacpan.org/pod/Crypt::URandom", "tags": ["Product"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/JDEGUEST/Apache2-API-v0.5.2/view/lib/Apache2/API/Password.pod", "tags": ["Product"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/JDEGUEST/Apache2-API-v0.5.3/changes", "tags": ["Release Notes"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://security.metacpan.org/docs/guides/random-data-for-security.html", "tags": ["Product"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2026/04/15/4", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.openwall.com/lists/oss-security/2026/04/15/5", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-338"}]}], "descriptions": [{"lang": "en", "value": "Apache::API::Password versions through 0.5.2 for Perl can generate insecure random values for salts.\n\nThe _make_salt and _make_salt_bcrypt methods will attept to load Crypt::URandom and then Bytes::Random::Secure to generate random bytes for the salt. If those modules are unavailable, it will simply return 16 bytes generated with Perl's built-in rand function.\n\nThe rand function is unsuitable for cryptographic use.\n\nThese salts are used for password hashing."}, {"lang": "es", "value": "Las versiones de Apache::API::Password hasta la 0.5.2 para Perl pueden generar valores aleatorios inseguros para las sales.\n\nLos m\u00e9todos _make_salt y _make_salt_bcrypt intentar\u00e1n cargar Crypt::URandom y luego Bytes::Random::Secure para generar bytes aleatorios para la sal. Si esos m\u00f3dulos no est\u00e1n disponibles, simplemente devolver\u00e1 16 bytes generados con la funci\u00f3n rand incorporada de Perl.\n\nLa funci\u00f3n rand no es adecuada para uso criptogr\u00e1fico.\n\nEstas sales se utilizan para el hash de contrase\u00f1as."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jdeguest:apache\\:\\:api\\:\\:password:*:*:*:*:*:perl:*:*", "vulnerable": true, "matchCriteriaId": "C1E70901-982A-4073-9489-06791A187BDB", "versionEndExcluding": "0.5.3"}], "operator": "OR"}]}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}