Predictable Secret Generation Vulnerability in Authen::TOTP by Tchatzi
CVE-2026-46473

7.5HIGH

Key Information:

Vendor

Tchatzi

Status
Authen::totp
Vendor
CVE Published:
21 May 2026

What is CVE-2026-46473?

Earlier versions of the Authen::TOTP Perl library, specifically prior to 0.1.1, have a significant vulnerability due to the use of Perl's built-in rand function for secret generation. This method of generating secrets is predictable, making it highly unsuitable for secure cryptographic purposes. By exploiting this flaw, attackers could potentially derive the generated secrets, undermining the security of applications that rely on this library for time-based one-time passwords (TOTP). It is recommended that users upgrade to version 0.1.1 or later to mitigate this risk.

Affected Version(s)

Authen::TOTP 0 < 0.1.1

References

https://metacpan.org/release/TCHATZI/Authen-TOTP-0.1.1/ch...
release-notes
https://github.com/tchatzi/Authen-TOTP/commit/d04f30cc653...
patch

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.