Executive brief
Amon2::Plugin::Web::CSRFDefender is a Perl module used to protect web applications against Cross-Site Request Forgery (CSRF) attacks. A vulnerability in how it generates security identifiers means that an attacker could potentially predict these IDs if the system's primary secure random number generator is unavailable. This could allow an attacker to bypass security protections, though the module has been deprecated by its author.
Technical details
The vulnerability exists in the generate_session_id function within Amon2::Plugin::Web::CSRFDefender. When /dev/urandom is inaccessible, the module falls back to a weak PRNG (CWE-338) using a SHA-1 hash seeded with the built-in Perl rand() function, the process ID (PID), and high-resolution epoch time. Because the PID space is limited and the epoch time can be guessed or observed via HTTP Date headers, the resulting identifiers are predictable (CWE-340). This allows for potential session hijacking or CSRF bypass. The issue is addressed in version 7.04, though the module is now deprecated.
Affected products
- TOKUHIROM Amon2::Plugin::Web::CSRFDefender 7.00 through 7.03
Timeline
- 2026-04-08: advisory: Initial publication of CVE-2026-5082
- 2026-04-08: disclosed