Crypt::SaltedHash, a Perl module produced by RRWO, creates salts for hashing using Perl's built‑in rand function. This function is intended for non‑cryptographic uses and produces predictable values, violating the requirement for cryptographic randomness. The result is that salts can be guessed or reproduced, which weakens the uniqueness of salted hashes and can allow attackers to pre‑compute or brute‑force hash values, undermining the confidentiality of protected data. This weakness is identified as CWE‑338: Insecure Random Number Generation.

The issue impacts all deployments of Crypt::SaltedHash version 0.09 or earlier, including the default Perl distributions that bundle this module. Any application that imports this module to hash passwords, tokens, or other sensitive material is affected.

The CVSS score of 9.1 reflects a high severity level. The EPSS score is < 1%, indicating that the probability of exploitation is presently low. The vulnerability is not listed in CISA's KEV catalog, but this absence does not diminish its potential impact. Based on the description, it is inferred that the attack vector is local or script‑based within the application that uses the module. If an attacker can manipulate or observe the hashing process, they could predict or reproduce the salt, enabling efficient offline attacks against stored credentials.