CVE-2025-40923

Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems.

• CWE-338
• CWE-340

• https://github.com/plack/Plack-Middleware-Session/commit/1fbfbb355e34e7f4b3906f66cf958cedadd2b9be.patch
• https://github.com/plack/Plack-Middleware-Session/pull/52
• https://metacpan.org/release/MIYAGAWA/Plack-Middleware-Session-0.34/source/lib/Plack/Session/State.pm#L22
• https://security.metacpan.org/docs/guides/random-data-for-security.html
• http://www.openwall.com/lists/oss-security/2025/07/16/4

Published

Jul 16, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-40915Mojolicious::Plugin::CSRF 1.03 for Perl uses a weak random n…7
• CVE-2025-40916Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a…9.1
• CVE-2025-40918Authen::SASL::Perl::DIGEST_MD5 versions 2.04 through 2.1800 …6.5
• CVE-2025-40919Authen::DigestMD5 versions 0.01 through 0.02 for Perl genera…6.5
• CVE-2025-4092Memory safety bugs present in Firefox 137 and Thunderbird 13…6.5
• CVE-2025-40920Catalyst::Authentication::Credential::HTTP versions 1.018 an…8.6
• CVE-2025-40924Catalyst::Plugin::Session before version 0.44 for Perl gener…6.5
• CVE-2025-40925Starch versions 0.14 and earlier generate session ids insecu…9.1
• CVE-2025-40926Plack::Middleware::Session::Simple versions before 0.05 for …9.8
• CVE-2025-40927CGI::Simple versions before 1.282 for Perl has a HTTP respon…7.3
• CVE-2025-40928JSON::XS before version 4.04 for Perl has an integer buffer …7.5
• CVE-2025-40929Cpanel::JSON::XS before version 4.40 for Perl has an integer…5.6