CVE-2026-5085
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
13/04/2026
Last modified:
23/04/2026
Description
Solstice::Session versions through 1440 for Perl generates session ids insecurely.<br />
<br />
The _generateSessionID method returns an MD5 digest seeded by the epoch time, a random hash reference, a call to the built-in rand() function and the process id.<br />
<br />
The same method is used in the _generateID method in Solstice::Subsession, which is part of the same distribution.<br />
<br />
The epoch time may be guessed, if it is not leaked in the HTTP Date header. Stringified hash refences will contain predictable content. The built-in rand() function is seeded by 16-bits and is unsuitable for security purposes. The process id comes from a small set of numbers.<br />
<br />
Predictable session ids could allow an attacker to gain access to systems.
Impact
Base Score 3.x
9.10
Severity 3.x
CRITICAL
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:mcrawfor:solstice\:\:session:1440:*:*:*:*:perl:*:* |
To consult the complete list of CPE names with products and versions, see this page