Insecure Session IDs in Dancer2 for Perl Leading to Potential Access Vulnerabilities

CVE-2026-13577

What is CVE-2026-13577?

Dancer2 versions prior to 2.1.0 exhibit a serious vulnerability where insecure session IDs are generated if secure random number generators are unavailable. The core component, Dancer2::Core::Role::SessionFactory, falls back to a built-in random ID generation method that relies on the insecure rand function, leading to low-entropy session IDs that can be easily predicted. This flaw poses a significant risk as an attacker could potentially guess session IDs, gaining unauthorized access to sensitive areas of the application. Proper session management is crucial for protecting user data and maintaining security integrity.

References