CVE-2026-9692 — Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely
Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built-in r…
Published: 2026-06-18 · CVSS: 5.3 · CVSS 3.1
Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, the heap address of an anonymous hash, and the PID. These are predictable or low-entropy sources that are unsuitable for security purposes.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7