Executive brief
CGI::Session is a Perl library used to manage user sessions in web applications. A vulnerability in its default ID generator allows attackers to predict session identifiers because they are created using non-secure, predictable data like the time and process ID. An attacker who successfully guesses a session ID can impersonate a legitimate user and bypass authentication controls.
Technical details
The `generate_id` method in CGI::Session::ID::md5 (prior to version 4.49) constructs session identifiers by taking an MD5 hash of the process ID (PID), the current epoch time, and Perl's built-in `rand()` function. These are considered low-entropy sources: PIDs are often within a small predictable range, epoch time can be synchronized via HTTP headers, and `rand()` is a linear congruential generator that is not cryptographically secure. A remote attacker can brute-force or calculate these values to predict active session IDs, leading to session hijacking and authentication bypass. The vulnerability is addressed in version 4.49 by switching to `Crypt::SysRandom` for ID generation.
Affected products
- MARKSTOS CGI::Session::ID::md5 before 4.49
Timeline
- 2026-06-30: patched: Version 4.49 released with security fix.
- 2026-07-01: advisory: CVE-2026-56016 published.