CVE-2026-5088 — Apache::API::Password versions through 0.5.2 for Perl can generate insecure random values for salts
Apache::API::Password versions through 0.5.2 for Perl can generate insecure random values for salts. The _make_salt and _make_salt_bcrypt methods will attept to load Crypt::URa…
Published: 2026-04-15 · CVSS: 7.5 · CVSS 3.1
Apache::API::Password versions through 0.5.2 for Perl can generate insecure random values for salts. The _make_salt and _make_salt_bcrypt methods will attept to load Crypt::URandom and then Bytes::Random::Secure to generate random bytes for the salt. If those modules are unavailable, it will simply return 16 bytes generated with Perl's built-in rand function. The rand function is unsuitable for cryptographic use. These salts are used for password hashing.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7