Junglewise Threat Intelligence

CVE-2026-5085: Solstice Solstice::Session predictable session ID generation

CVE-2026-5085 · Severity: critical · CVSS 9.1 · Published 2026-04-13

Executive brief

Solstice::Session is a Perl library used to manage user sessions in web applications. A security flaw in how it creates session identifiers makes them predictable to attackers. This could allow an unauthorized person to guess a valid session ID and gain full access to a user's account or the underlying system.

Technical details

The vulnerability exists in the _generateSessionID method of Solstice::Session (and _generateID in Solstice::Subsession), which generates session IDs using an MD5 digest of predictable inputs. The seed includes the epoch time (often available in HTTP headers), a stringified hash reference, the process ID, and the output of Perl's built-in rand() function. Because rand() is seeded with only 16-bits and the other components are easily guessed or leaked, the resulting session IDs are cryptographically weak. An attacker can brute-force or predict these IDs to hijack active sessions without authentication. No patch is currently specified in the advisory, but the use of cryptographically secure PRNGs like Crypt::URandom is recommended for remediation.

Affected products

  • Solstice Solstice::Session through 1440
  • Solstice Solstice::Subsession through 1440

Timeline

  • 2026-04-13: disclosed: Advisory published on oss-security mailing list
  • 2026-04-13: advisory: NVD publication date

References