The Amazon::Credentials Perl module versions through 1.2.0 uses the built‑in rand function to create a 64‑bit encryption key, which is predictable and unsuitable for cryptographic purposes. Because secrets are stored in an obfuscated form using this key, an attacker who can generate the expected rand sequence can derive the key and decrypt the credentials, directly compromising the confidentiality of stored secrets without requiring additional access beyond what is needed to read the encrypted data. This weakness falls under the cryptographically weak key generation flaw (CWE‑338).

All versions of the BIGFOOT:Amazon::Credentials Perl module up to and including 1.2.0 are affected, as the issue is present in the encryption logic used in those releases.

The vulnerability has no publicly known CVSS score or EPSS value, and it has not been listed in the CISA KEV catalog. However, the predictability of the rand‑based key allows a threat actor with read access to the encrypted credentials to compute the key. The attack vector is most likely local or application‑level, requiring the ability to read the obfuscated secrets, after which the attacker can decrypt them. The confidentiality impact is significant for any system that stores sensitive data using this module.