CVE-2026-8503

Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids. Apache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator returns a SHA-256 hash of the built-in rand() function, the epoch time, and the PID, that is hashed again. These are predictable, low-entropy sources. Predicable session ids could allow an attacker to gain access to systems. Note that version 1.3.19 has a fallback without warning to use insecure session generation method if the call to Crypt::URandom::urandom fails. However, this is unlikely as Crypt::URandom is a hardcoded requirement of the module. This issue is similar to CVE-2025-40931 for Apache::Session::Generate::MD5.

• CWE-338
• CWE-340

• https://github.com/LemonLDAPNG/Apache-Session-Browseable/commit/cc915cbbd266776eec3dd8bf4748b15fa827dbd0.patchPatch
• https://metacpan.org/release/GUIMARD/Apache-Session-Browseable-1.3.19/changesRelease Notes
• https://metacpan.org/release/GUIMARD/Apache-Session-Browseable-1.3.19/diff/GUIMARD/Apache-Session-Browseable-1.3.18#lib/Apache/Session/Generate/SHA256.pmProduct
• https://www.cve.org/CVERecord?id=CVE-2025-40931Third Party Advisory
• https://www.cve.org/CVERecord?id=CVE-2025-40932Third Party Advisory

Published

May 15, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-85021A vulnerability was determined in langgenius dify 1.13.0. Af…4.3
• CVE-2026-85022A vulnerability was identified in langgenius dify 1.13.0. Af…3.5
• CVE-2026-85024undici bundles a WebSocket client whose permessage-deflate s…5.9
• CVE-2026-85025IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow a…9.8
• CVE-2026-85028Creation of a temporary file in a directory with insecure pe…7.8
• CVE-2026-85029IBM Guardium Data Protection 12.2 could allow a remote attac…7.5
• CVE-2026-85030A vulnerability has been found in HKUDS AI-Trader up to d03f…3.7
• CVE-2026-85031A vulnerability was found in TOTOLINK CP450 4.1.0. The impac…9.9
• CVE-2026-85037The Sunshine Photo Cart WordPress plugin before 3.7 does no…5.3
• CVE-2026-85038The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin …5.3
• CVE-2026-85040A weakness has been identified in ZhongBangKeJi CRMEB up to …4.7
• CVE-2026-85042Use after free in DevTools in Google Chrome prior to 152.0.7…9.6