CVE-2025-40926

Plack::Middleware::Session::Simple versions before 0.05 for Perl generates session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predictable session ids could allow an attacker to gain access to systems. Plack::Middleware::Session::Simple is intended to be compatible with Plack::Middleware::Session, which had a similar security issue CVE-2025-40923.

• CWE-338
• CWE-340

• https://github.com/kazeburo/Plack-Middleware-Session-Simple/commit/760bb358b8f53e52cf415888a4ac858fd99bb24e.patchPatch
• https://github.com/kazeburo/Plack-Middleware-Session-Simple/pull/4Issue Tracking, Patch
• https://metacpan.org/release/KAZEBURO/Plack-Middleware-Session-Simple-0.04/source/lib/Plack/Middleware/Session/Simple.pm#L43Issue Tracking, Product
• https://metacpan.org/release/KAZEBURO/Plack-Middleware-Session-Simple-0.05/changes
• https://security.metacpan.org/docs/guides/random-data-for-security.htmlThird Party Advisory
• https://www.cve.org/CVERecord?id=CVE-2025-40923Third Party Advisory

Published

Mar 5, 2026

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-40919Authen::DigestMD5 versions 0.01 through 0.02 for Perl genera…6.5
• CVE-2025-4092Memory safety bugs present in Firefox 137 and Thunderbird 13…6.5
• CVE-2025-40920Catalyst::Authentication::Credential::HTTP versions 1.018 an…8.6
• CVE-2025-40923Plack-Middleware-Session before version 0.35 for Perl genera…7.3
• CVE-2025-40924Catalyst::Plugin::Session before version 0.44 for Perl gener…6.5
• CVE-2025-40925Starch versions 0.14 and earlier generate session ids insecu…9.1
• CVE-2025-40927CGI::Simple versions before 1.282 for Perl has a HTTP respon…7.3
• CVE-2025-40928JSON::XS before version 4.04 for Perl has an integer buffer …7.5
• CVE-2025-40929Cpanel::JSON::XS before version 4.40 for Perl has an integer…5.6
• CVE-2025-4093Memory safety bug present in Firefox ESR 128.9, and Thunderb…8.1
• CVE-2025-40930JSON::SIMD before version 1.07 and earlier for Perl has an i…7.5
• CVE-2025-40931Apache::Session::Generate::MD5 versions through 1.94 for Per…9.1