Executive brief
The Trog::TOTP library, used for generating two-factor authentication (2FA) codes in Perl applications, was found to use a weak method for creating security secrets. Because these secrets were generated using a predictable random number generator, an attacker might be able to guess the secret keys used to protect user accounts. This could allow an unauthorized person to bypass multi-factor authentication protections.
Technical details
Trog::TOTP prior to version 1.006 utilized Perl's built-in 'rand()' function to generate TOTP secrets. This function is a pseudo-random number generator (PRNG) that is not cryptographically secure, leading to insufficient entropy (CWE-331). An attacker who can predict the output of the PRNG may be able to determine the shared secrets used for Time-based One-Time Passwords, effectively bypassing 2FA. The issue was resolved in version 1.006 by migrating to 'Crypt::PRNG::rand()', which provides cryptographically strong randomness.
Affected products
- TEODESIAN Trog::TOTP < 1.006
Timeline
- 2026-05-15: disclosed
- 2026-05-15: patched: Version 1.006 released
- 2026-05-15: advisory