Insecure Session ID Generation in Dancer Framework by Dancer

CVE-2026-5080

What is CVE-2026-5080?

The Dancer::Session::Abstract framework versions up to 1.3522 improperly generate session IDs, leading to potential security risks. The generation process includes predictable components, such as the absolute pathname, process ID, and the time of the operation, all of which may be guessed by an attacker. The process ID is limited to a small range and may be sequential, while the random number generated via the built-in rand() function is not secure for cryptographic purposes. This vulnerability can allow malicious actors to predict or intercept session IDs, thereby compromising user sessions and gaining unauthorized access to sensitive information.

References