CVE-2026-5080

This vulnerability exists in the Perl module Dancer::Session::Abstract released through version 1.3522. Session identifiers are created by summing the character codepoints of the absolute pathname, the process identifier, the epoch time, and multiple calls to Perl's built-in rand() function, then concatenating the result three times. Because the pathname can be known or guessed, the epoch time can be inferred or leaked via HTTP headers, the process ID comes from a limited set of numbers, and rand() is seeded with a weak 32‑bit value, the generated session IDs are highly predictable. This falls under CWE-338 and CWE-340, in which a cryptographically insecure random number generator is used.

The affected product is BIGPRESH's Dancer::Session::Abstract, any installation of the module through version 1.3522. All applications that rely on the default session ID generation mechanism within that version range are impacted; no specific operating system or deployment environment was mentioned, so the threat covers all environments where this module is active.

The CVSS score is 5.9, indicating moderate severity. The EPSS score is not available, indicating limited public exploitation data, and the defect is not listed in the CISA KEV catalog. An attacker can exploit this weakness by guessing or brute‑forcing session identifiers, especially when the application uses standard installation locations that reveal the pathname, exposes epoch time in HTTP headers, or runs with process IDs that are sequential. The existence of an official patch mitigates the risk by improving the randomness of session ID construction.