The generate_session_id function will attempt to read bytes from the /dev/urandom device, but if that is unavailable then it generates bytes using SHA-1 hash seeded with the built-in rand() function, the PID, and the high resolution epoch time. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.
Amon2::Plugin::Web::CSRFDefender versions before 7.00 were part of Amon2, which was vulnerable to insecure session ids due to CVE-2025-15604.
Note that the author has deprecated this module.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| TOKUHIROM | Amon2::Plugin::Web::CSRFDefender | unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to Amon2::Plugin::Web::CSRFDefender version 7.04 or later.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 08 Apr 2026 16:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Wed, 08 Apr 2026 06:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Amon2::Plugin::Web::CSRFDefender versions from 7.00 through 7.03 for Perl generate an insecure session id. The generate_session_id function will attempt to read bytes from the /dev/urandom device, but if that is unavailable then it generates bytes using SHA-1 hash seeded with the built-in rand() function, the PID, and the high resolution epoch time. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Amon2::Plugin::Web::CSRFDefender versions before 7.00 were part of Amon2, which was vulnerable to insecure session ids due to CVE-2025-15604. Note that the author has deprecated this module. | |
| Title | Amon2::Plugin::Web::CSRFDefender versions from 7.00 through 7.03 for Perl generate an insecure session id | |
| Weaknesses | CWE-338 CWE-340 |
|
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-04-08T16:09:26.357Z
Reserved: 2026-03-28T19:12:35.387Z
Link: CVE-2026-5082
Vulnrichment
Updated: 2026-04-08T16:09:22.763Z
NVD
Status : Received
Published: 2026-04-08T06:16:28.993
Modified: 2026-04-08T06:16:28.993
Link: CVE-2026-5082
Redhat
No data.
OpenCVE Enrichment
No data.