CVE-2026-5082
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
08/04/2026
Last modified:
23/04/2026
Description
Amon2::Plugin::Web::CSRFDefender versions from 7.00 through 7.03 for Perl generate an insecure session id.<br />
<br />
The generate_session_id function will attempt to read bytes from the /dev/urandom device, but if that is unavailable then it generates bytes using SHA-1 hash seeded with the built-in rand() function, the PID, and the high resolution epoch time. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.<br />
<br />
Amon2::Plugin::Web::CSRFDefender versions before 7.00 were part of Amon2, which was vulnerable to insecure session ids due to CVE-2025-15604.<br />
<br />
Note that the author has deprecated this module.
Impact
Base Score 3.x
5.30
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:tokuhirom:amon2\:\:plugin\:\:web\:\:csrfdefender:*:*:*:*:*:perl:*:* | 7.00 (including) | 7.03 (including) |
To consult the complete list of CPE names with products and versions, see this page