Riskcovery

CVE-2026-5083

Ado::Sessions versions through 0.935 for Perl generates insecure session ids

State
Published
Severity
5.3 Medium
Published
Apr 8, 2026
Updated
Apr 8, 2026
Reserved
Mar 28, 2026

Read the record on cve.org

Description

Ado::Sessions versions through 0.935 for Perl generates insecure session ids.

The session id is generated from a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.

Predicable session ids could allow an attacker to gain access to systems.

Note that Ado is no longer maintained, and has been removed from the CPAN index. It is still available on BackPAN.

Scores

CVSSScoreVectorSource
3.15.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LCISA-ADP

Weaknesses

  • CWE-340 Generation of Predictable Numbers or Identifiers
  • CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator

Affected Products

ProductVersions
Ado::SessionsBEROV
  • 0.935 and earlierAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.