What’s Vulnerable › Vulnerabilities

CVE-2009-10007: Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-09 · updated 2026-07-21
• Weakness: CWE-384

Description

Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks. Catalyst::Plugin::Authentication does not automatically change the session id after authentication. An attacker that obtains a session id cookie can use this to impersonate the victim.

Affected products

• ETHER Catalyst::Plugin::Authentication: before 0.10_027 — fixed in 0.10_027

How to fix

Upgrade to a fixed version: ETHER Catalyst::Plugin::Authentication 0.10_027. Check the vendor advisory for mitigations.

References

• https://github.com/perl-catalyst/Catalyst-Plugin-Authentication/commit/b1385ea87a2491b64f33169222af19982d0acce3.patch
• https://metacpan.org/pod/Catalyst::Plugin::Session#change_session_id
• https://metacpan.org/pod/Plack::Middleware::Session#change_id
• https://metacpan.org/release/ETHER/Catalyst-Plugin-Authentication-0.10_027/changes
• http://www.openwall.com/lists/oss-security/2026/06/09/10

Get alerted when CVE-2009-10007 or the next vulnerability affects your stack