Executive brief
Ado::Sessions, a Perl library used for managing user sessions in web applications, generates session identifiers that are predictable. This flaw could allow an unauthorized person to guess a valid user's session ID and gain access to their account or the system. Because the software is no longer maintained, users are at risk as no official security updates will be released.
Technical details
Ado::Sessions (up to version 0.935) uses a weak algorithm to generate session identifiers in the Ado::Sessions::generate_id routine. The IDs are created by SHA-1 hashing a seed composed of the Perl built-in rand() function, the system epoch time, and the process ID (PID). Because the PID space is small, the epoch time is often discoverable via HTTP Date headers, and the built-in rand() function is a non-cryptographic PRNG, an attacker can brute-force or predict active session IDs. The software is end-of-life (EOL) and has been removed from the CPAN index, meaning no patch is expected.
Affected products
- BEROV Ado::Sessions through 0.935
Timeline
- 2017-09-02: other: Last version of Ado released on CPAN
- 2018-09-24: other: Developer announced Ado will no longer be updated
- 2026-04-08: disclosed: Vulnerability disclosed via oss-security mailing list
- 2026-04-08: advisory: NVD publication date