Session ID Generation Flaw in Catalyst Plugin for Perl

CVE-2025-40924

What is CVE-2025-40924?

The Catalyst::Plugin::Session for Perl before version 0.44 generates session IDs using a combination of low-entropy data sources including counters, epoch time, and the built-in random function. This method results in predictable session IDs, risking unauthorized access by potential attackers. The entropy of the session ID generation process is notably weak, as it relies on information such as process identifier (PID) and epoch time, which may be easily guessed or derived. Consequently, this vulnerability highlights the necessity for a more robust, cryptographically secure method for generating session identifiers to ensure data protection and prevent session hijacking.

References