Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id when both Math::Random::ISAAC::XS and Crypt::URandom are unavailable.
The fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function).
These are all low-entropy and easily guessed sources.
The built-in rand() function is seeded with 32-bits and considered unsuitable for security applications.
Predictable session ids could allow an attacker to gain access to systems.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| CROMEDOME | Dancer2 | unaffected |
|
No data.
No data.
No data available yet.
Vendor Workaround
Ensure Crypt::URandom and Math::Random::ISAAC::XS modules are installed in the application PERL5LIB path.
Tracking
Sign in to view the affected projects.
No advisories yet.
Mon, 20 Jul 2026 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Mon, 20 Jul 2026 08:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Dancer2 versions through 2.1.0 for Perl generate insecure session ids when CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id when both Math::Random::ISAAC::XS and Crypt::URandom are unavailable. The fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function). These are all low-entropy and easily guessed sources. The built-in rand() function is seeded with 32-bits and considered unsuitable for security applications. Predictable session ids could allow an attacker to gain access to systems. | |
| Title | Dancer2 versions through 2.1.0 for Perl generate insecure session ids when CSPRNG modules are unavailable | |
| Weaknesses | CWE-338 CWE-340 |
|
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-07-20T13:05:10.916Z
Reserved: 2026-06-28T20:59:07.978Z
Link: CVE-2026-13577
Vulnrichment
Updated: 2026-07-20T13:04:57.336Z
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.