CVE-2026-5084

WebDyne::Session versions before 3.003_704 for Perl generate the session id insecurely. The session handler generates the session id from an MD5 hash seeded with a call to the built-in rand() function. The rand function is passed a maximum value based on the process id, the epoch time and the reference address of the object, but this information will have no effect on the overall quality of the seed of the message digest. The rand function is seeded by 32-bits and is predictable. It is considered unsuitable for cryptographic purposes. Predictable session ids could allow an attacker to gain access to systems. Note that WebDyne::Session versions 1.042 and earlier appear to be in separate distributions from WebDyne.

• CWE-338
• CWE-340

• https://github.com/aspeer/WebDyne/commit/7a3f949dc24e62a276eb0db629db64aca356e954.patch
• https://metacpan.org/release/ASPEER/WebDyne-2.075/source/lib/WebDyne/Session.pm#L120
• https://security.metacpan.org/docs/guides/random-data-for-security.html
• https://webdyne.org
• http://www.openwall.com/lists/oss-security/2026/05/11/3

Published

May 11, 2026

Last Modified

Aug 2, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50810A NULL pointer dereference in smooth_parse_stream_index() in…5.5
• CVE-2026-50811An out-of-bounds read vulnerability exists in FreeType 2.14.…6.5
• CVE-2026-50812A NULL pointer dereference in the SQLite Session Extension i…5.5
• CVE-2026-50813An issue in SQLite before Fossil check-in 869a51ae84df allow…6.1
• CVE-2026-5082Amon2::Plugin::Web::CSRFDefender versions from 7.00 through …5.3
• CVE-2026-5083Ado::Sessions versions through 0.935 for Perl generates inse…5.3
• CVE-2026-5085Solstice::Session versions through 1440 for Perl generates s…9.1
• CVE-2026-5086Crypt::SecretBuffer versions before 0.019 for Perl is susece…7.5
• CVE-2026-50869An issue in the api/plugin.php component of Bludit v3.19.0 a…9.8
• CVE-2026-5087PAGI::Middleware::Session::Store::Cookie versions through 0.…7.5
• CVE-2026-50870An information disclosure vulnerability in the configuration…7.5
• CVE-2026-50871An OS command injection vulnerability in the media archiving…9.8