CVE-2026-5081

Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure. Apache::Session::Generate::ModUniqueId (added in version 1.54) uses the value of the UNIQUE_ID environment variable for the session id. The UNIQUE_ID variable is set by the Apache mod_unique_id plugin, which generates unique ids for the request. The id is based on the IPv4 address, the process id, the epoch time, a 16-bit counter and a thread index, with no obfuscation. The server IP is often available to the public, and if not available, can be guessed from previous session ids being issued. The process ids may also be guessed from previous session ids. The timestamp is easily guessed (and leaked in the HTTP Date response header). The purpose of mod_unique_id is to assign a unique id to requests so that events can be correlated in different logs. The id is not designed, nor is it suitable for security purposes.

• CWE-340
• CWE-341

• https://httpd.apache.org/docs/current/mod/mod_unique_id.htmlProduct
• https://metacpan.org/pod/Apache::Session::Generate::RandomProduct
• http://www.openwall.com/lists/oss-security/2026/05/06/6Mailing List, Third Party Advisory
• https://access.redhat.com/security/cve/CVE-2026-5081
• https://bugzilla.redhat.com/show_bug.cgi?id=2467174
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5081.json

Published

May 6, 2026

Last Modified

Jul 15, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50767A stored cross-site scripting (XSS) vulnerability in the ite…5.4
• CVE-2026-5077The Total theme for WordPress is vulnerable to Stored Cross-…5.4
• CVE-2026-5078Impact: The morgan logging middleware's :remote-user token e…5.3
• CVE-2026-50782Jinher OA C6 contains an XML External Entity (XXE) injection…7.5
• CVE-2026-5079Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.…7.5
• CVE-2026-5080Dancer::Session::Abstract versions through 1.3522 for Perl g…5.9
• CVE-2026-50810A NULL pointer dereference in smooth_parse_stream_index() in…5.5
• CVE-2026-50811An out-of-bounds read vulnerability exists in FreeType 2.14.…6.5
• CVE-2026-50812A NULL pointer dereference in the SQLite Session Extension i…5.5
• CVE-2026-50813An issue in SQLite before Fossil check-in 869a51ae84df allow…6.1
• CVE-2026-5082Amon2::Plugin::Web::CSRFDefender versions from 7.00 through …5.3
• CVE-2026-5083Ado::Sessions versions through 0.935 for Perl generates inse…5.3