Executive brief
Mojolicious::Sessions::Storable is a Perl module used to manage user sessions in web applications. A security flaw in how it creates session identifiers makes them predictable, potentially allowing an attacker to guess a valid user's session ID. This could lead to unauthorized access to user accounts or sensitive data stored within those sessions.
Technical details
Mojolicious::Sessions::Storable (through version 0.05) utilizes an insecure session ID generation mechanism in its sid_generator routine. The generator produces a SHA-1 hash seeded with the built-in Perl rand() function, the current epoch time, the process ID (PID), and the heap address of an anonymous hash. Because these sources are predictable or provide low entropy, an attacker can potentially brute-force or predict session identifiers. This vulnerability is classified under CWE-338 (Use of Cryptographically Weak PRNG) and CWE-340 (Generation of Predictable Identifiers). A patch has been developed by CPANSec to address this by utilizing more secure random data sources.
Affected products
- HAYAJO Mojolicious::Sessions::Storable through 0.05
Timeline
- 2026-06-18: disclosed
- 2026-06-18: advisory
References
- https://cpan.org/modules
- https://metacpan.org/release/HAYAJO/Mojolicious-Plugin-SessionStore-0.05/source/lib/Mojolicious/Sessions/Storable.pm
- https://security.metacpan.org/docs/guides/random-data-for-security.html
- https://security.metacpan.org/patches/M/Mojolicious-Plugin-SessionStore/0.05/CVE-2026-9692-r1.patch
- https://www.cve.org/CVERecord?id=CVE-2025-40923