CVE-2026-56016

CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources.<br /> <br /> The generate_id method builds the session id from a MD5 digest of the process id, the epoch time, and the built-in rand() function. All three are predictable, low-entropy sources: the PID is drawn from a small range, the epoch time can be guessed or read from the HTTP Date header, and Perl&amp;#39;s rand() is unsuitable for security purposes because it is predictable and reversible.<br /> <br /> An attacker who predicts a session id can impersonate the corresponding session and bypass authentication.