Junglewise Threat Intelligence

CVE-2026-8503: Apache::Session::Browseable Predictable Session ID Generation

CVE-2026-8503 · Severity: medium · CVSS 6.5 · Published 2026-05-15

Executive brief

Apache::Session::Browseable is a Perl library used to manage web sessions, often in authentication systems like LemonLDAP::NG. A vulnerability in how it creates session identifiers makes them predictable to an attacker. This could allow an unauthorized person to guess a valid user's session ID and gain access to their account or sensitive systems without a password.

Technical details

The Apache::Session::Generate::SHA256 module within the Apache::Session::Browseable distribution used a weak seeding mechanism for session ID generation. Specifically, it relied on a combination of the Perl built-in rand() function, the current epoch time, the process ID (PID), and a stringified hash reference, which were then hashed with SHA-256. These sources provide insufficient entropy, making the resulting session IDs predictable via brute-force or targeted estimation. An attacker could exploit this to perform session hijacking. The fix in version 1.3.19 migrates the generator to use Crypt::URandom for cryptographically secure random number generation, though it retains the weak method as a silent fallback if the secure generator fails.

Affected products

  • LemonLDAP::NG Team Apache::Session::Browseable < 1.3.19

Timeline

  • 2026-05-14: patched: Fix committed to repository
  • 2026-05-15: disclosed: CVE published

References