Bytes::Random::Secure versions through 0.29 for Perl store the internal state of the pseudorandom number generator in a process‑wide global. When an object is created before a fork, or when the functional API is used, that state is duplicated in child processes, causing each process to generate the same sequence of random numbers. Secrets produced in a multiprocess application are therefore identical and predictable, creating a risk that attackers can anticipate or replay secret values.

The vulnerability affects the DAVIDO Bytes::Random::Secure CPAN module, versions 0.29 and earlier. Applications that import this module and use it in a forked environment are impacted.

The likely attack vector is an application that uses Bytes::Random::Secure before forking and relies on the generated values for cryptographic or authentication purposes. Based on the description, it is inferred that an attacker who can influence or observe a forked process may predict deterministic secrets. Because no EPSS score is published and the vulnerability is not listed in the CISA KEV catalog, the raw risk level is unclear, but the nature of the flaw is serious. No CVSS score is provided, and the consequences could allow exploitation of predictable secrets.