Executive brief
Apache::Session::Browseable is a Perl library used to manage web sessions, often in authentication systems like LemonLDAP::NG. A vulnerability in how it creates session identifiers makes them predictable to an attacker. This could allow an unauthorized person to guess a valid user's session ID and gain access to their account or sensitive systems without a password.
Technical details
The Apache::Session::Generate::SHA256 module within the Apache::Session::Browseable distribution used a weak seeding mechanism for session ID generation. Specifically, it relied on a combination of the Perl built-in rand() function, the current epoch time, the process ID (PID), and a stringified hash reference, which were then hashed with SHA-256. These sources provide insufficient entropy, making the resulting session IDs predictable via brute-force or targeted estimation. An attacker could exploit this to perform session hijacking. The fix in version 1.3.19 migrates the generator to use Crypt::URandom for cryptographically secure random number generation, though it retains the weak method as a silent fallback if the secure generator fails.
Affected products
- LemonLDAP::NG Team Apache::Session::Browseable < 1.3.19
Timeline
- 2026-05-14: patched: Fix committed to repository
- 2026-05-15: disclosed: CVE published
References
- https://github.com/LemonLDAPNG/Apache-Session-Browseable/commit/cc915cbbd266776eec3dd8bf4748b15fa827dbd0.patch
- https://metacpan.org/release/GUIMARD/Apache-Session-Browseable-1.3.19/changes
- https://metacpan.org/release/GUIMARD/Apache-Session-Browseable-1.3.19/diff/GUIMARD/Apache-Session-Browseable-1.3.18
- https://www.cve.org/CVERecord?id=CVE-2025-40931
- https://www.cve.org/CVERecord?id=CVE-2025-40932