Executive brief
WebDyne::Session, a Perl library used for managing user sessions in web applications, generates session identifiers using a predictable method. Because these identifiers are not truly random, an attacker could potentially guess a valid user's session ID. This could allow an unauthorized person to hijack active user sessions and gain access to restricted areas of a system.
Technical details
WebDyne::Session (up to version 2.075) generates session identifiers by calculating an MD5 hash of a value produced by Perl's built-in rand() function. The rand() function is seeded with only 32 bits of entropy and is not cryptographically secure. While the implementation attempts to add entropy using the process ID, epoch time, and object reference address, these inputs do not improve the underlying quality of the 32-bit seed. A remote attacker can exploit this predictability to perform session hijacking by guessing or brute-forcing active session IDs. No patch is currently specified in the advisory, though the use of Crypt::URandom or similar CSPRNGs is recommended for remediation.
Affected products
- WebDyne WebDyne::Session through 2.075
Timeline
- 2026-05-11: advisory: CVE-2026-5084 published by NVD/CPANSec