What’s Vulnerable › Vulnerabilities

CVE-2026-5084: WebDyne::Session versions before 3.003_704 for Perl generate the session id insecurely

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-11 · updated 2026-10-26
• Weakness: CWE-338

Description

WebDyne::Session versions before 3.003_704 for Perl generate the session id insecurely. The session handler generates the session id from an MD5 hash seeded with a call to the built-in rand() function. The rand function is passed a maximum value based on the process id, the epoch time and the reference address of the object, but this information will have no effect on the overall quality of the seed of the message digest. The rand function is seeded by 32-bits and is predictable. It is considered unsuitable for cryptographic purposes. Predictable session ids could allow an attacker to gain access to systems. Note that WebDyne::Session versions 1.042 and earlier appear to be in separate distributions from WebDyne.

Affected products

• ASPEER WebDyne::Session: before 3.003_704 — fixed in 3.003_704

How to fix

Upgrade to a fixed version: ASPEER WebDyne::Session 3.003_704. Check the vendor advisory for mitigations.

References

• https://github.com/aspeer/WebDyne/commit/7a3f949dc24e62a276eb0db629db64aca356e954.patch
• https://metacpan.org/release/ASPEER/WebDyne-2.075/source/lib/WebDyne/Session.pm#L120
• https://security.metacpan.org/docs/guides/random-data-for-security.html
• https://webdyne.org
• http://www.openwall.com/lists/oss-security/2026/05/11/3

Get alerted when CVE-2026-5084 or the next vulnerability affects your stack