CVE-2026-5082
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
Amon2::Plugin::Web::CSRFDefender versions 7.00 through 7.03 for Perl generate an insecure session id. The generate_session_id function attempts to read from /dev/urandom, but if unavailable, generates bytes using SHA-1 seeded with rand(), PID, and epoch time. PID comes from a small set, and time may be guessed. The rand() function is unsuitable for cryptographic purposes.
Risk Assessment
Risk of session ID prediction and session hijacking. This could lead to unauthorized access to accounts.
Recommendation
Update Amon2::Plugin::Web::CSRFDefender to version 7.04 or later. If the module is deprecated, consider migrating to an alternative solution.
Original NVD description (English source)
Amon2::Plugin::Web::CSRFDefender versions from 7.00 through 7.03 for Perl generate an insecure session id. The generate_session_id function will attempt to read bytes from the /dev/urandom device, but if that is unavailable then it generates bytes using SHA-1 hash seeded with the built-in rand() function, the PID, and the high resolution epoch time. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Amon2::Plugin::Web::CSRFDefender versions before 7.00 were part of Amon2, which was vulnerable to insecure session ids due to CVE-2025-15604. Note that the author has deprecated this module.