The Apache::API::Password module generates random salts for password hashing. If the modules Crypt::URandom or Bytes::Random::Secure are unavailable, the code falls back to Perl's built‑in rand function, which is unsuitable for cryptographic use. Salts generated in this manner are predictable and weaken the security of the stored password hashes, making it easier for an attacker to perform offline brute‑force or rainbow‑table attacks on compromised credentials.

The vulnerability affects the JDEGUEST Apache::API::Password library, versions through 0.5.2 and earlier. Systems that use these versions for password hashing – such as Perl web applications that depend on this module – are impacted. No other vendor products are listed as affected in the CNA data.

The EPSS score is 0.00047 (<1%) and the vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed active exploitation at this time. However, the weakness directly compromises the confidentiality of stored passwords, a high‑impact asset. If an attacker obtains a password database, the predictable salts significantly reduce the effort required for offline cracking. The likely attack vector is a compromised system or a credential dump, and the weakness is exploitable by any party with access to hashed passwords or the application source that uses the vulnerable library.