CVE-2026-8503

Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids. Apache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator returns a SHA-256 hash of the built-in rand() function, the epoch time, and the PID, that is hashed again. These are predictable, low-entropy sources. Predicable session ids could allow an attacker to gain access to systems. Note that version 1.3.19 has a fallback without warning to use insecure session generation method if the call to Crypt::URandom::urandom fails. However, this is unlikely as Crypt::URandom is a hardcoded requirement of the module. This issue is similar to CVE-2025-40931 for Apache::Session::Generate::MD5.

• CWE-338
• CWE-340

• https://github.com/LemonLDAPNG/Apache-Session-Browseable/commit/cc915cbbd266776eec3dd8bf4748b15fa827dbd0.patchPatch
• https://metacpan.org/release/GUIMARD/Apache-Session-Browseable-1.3.19/changesRelease Notes
• https://metacpan.org/release/GUIMARD/Apache-Session-Browseable-1.3.19/diff/GUIMARD/Apache-Session-Browseable-1.3.18#lib/Apache/Session/Generate/SHA256.pmProduct
• https://www.cve.org/CVERecord?id=CVE-2025-40931Third Party Advisory
• https://www.cve.org/CVERecord?id=CVE-2025-40932Third Party Advisory

Published

May 15, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8496A cross-site scripting (XSS) vulnerability exists in Alinto …6.1
• CVE-2026-8497Improper certificate validation in the Devolutions Server co…7.4
• CVE-2026-8499The Helpfulcrowd Product Reviews plugin for WordPress is vul…5.3
• CVE-2026-8500Web::Passwd versions through 0.03 for Perl is vulnerable to …9.8
• CVE-2026-8501Improper access control in the PCTCore64.sys Windows kernel …7.8
• CVE-2026-8502The LearnPress – WordPress LMS Plugin for Create and Sell On…5.3
• CVE-2026-8505IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in…9.8
• CVE-2026-8507Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have o…9.8
• CVE-2026-8508An improper authentication vulnerability in the "social_logi…6.5
• CVE-2026-8509Heap buffer overflow in WebML in Google Chrome prior to 148.…8.8
• CVE-2026-8510Integer overflow in Skia in Google Chrome on Windows prior t…7.5
• CVE-2026-8511Use after free in UI in Google Chrome prior to 148.0.7778.16…9.6