Insecure Session ID Generation in Plack::Middleware::Session::Simple by Kazeburo

CVE-2025-40926

What is CVE-2025-40926?

Plack::Middleware::Session::Simple, a Perl middleware, generates session IDs using a method that combines SHA-1 hashing with a non-cryptographically secure random number generator, the built-in rand function. It also incorporates the current epoch time and process ID, leading to session IDs that are predictable. This flaw allows attackers to exploit known values, potentially gaining unauthorized access to user sessions. This middleware's predictable session IDs pose a significant security risk, especially in environments that require robust session management.

References