Executive brief
Catalyst::Plugin::Authentication is a Perl library used to manage user logins in web applications. In versions before 0.10_027, the library fails to refresh a user's session ID after they log in. This allows an attacker to potentially hijack a user's account by "fixing" a session ID in the victim's browser before they sign in, leading to unauthorized access to the victim's data and actions.
Technical details
Catalyst::Plugin::Authentication before version 0.10_027 is susceptible to session fixation (CWE-384). The vulnerability exists because the plugin does not call change_session_id or an equivalent rotation mechanism during the authentication transition. An attacker can provide a known session identifier to a victim (e.g., via cookie injection or URL parameters depending on the session state configuration); once the victim authenticates, the attacker can use the same identifier to impersonate the authenticated user. The fix introduces a 'rotate_session_id' configuration setting, enabled by default in version 0.10_027, which requires Catalyst::Plugin::Session version 0.25 or higher to function correctly.
Affected products
- Perl Catalyst Catalyst::Plugin::Authentication before 0.10_027
Timeline
- 2026-06-09: advisory: NVD publication date
- 2026-06-07: patched: Patch committed to GitHub repository
References
- https://github.com/perl-catalyst/Catalyst-Plugin-Authentication/commit/b1385ea87a2491b64f33169222af19982d0acce3.patch
- https://metacpan.org/pod/Catalyst::Plugin::Session
- https://metacpan.org/pod/Plack::Middleware::Session
- https://metacpan.org/release/ETHER/Catalyst-Plugin-Authentication-0.10_027/changes