{"id":"CVE-2026-13577","summary":"Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable","details":"Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable.\n\nDancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available.\n\nThe fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function).\n\nThese are all low-entropy and easily guessed sources.\n\nThe built-in rand() function is seeded with 32-bits and considered unsuitable for security applications.\n\nPredictable session ids could allow an attacker to gain access to systems.","modified":"2026-09-21T03:45:49.157851465Z","published":"2026-07-20T07:11:10.403Z","database_specific":{"cna_assigner":"CPANSec","cwe_ids":["CWE-338","CWE-340"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13577.json"},"references":[{"type":"WEB","url":"https://cpan.org/modules"},{"type":"WEB","url":"https://github.com/PerlDancer/Dancer2/blob/v2.1.0/lib/Dancer2/Core/Role/SessionFactory.pm#L142"},{"type":"WEB","url":"https://www.cve.org/CVERecord?id=CVE-2026-5080"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13577.json"},{"type":"ADVISORY","url":"https://metacpan.org/release/CROMEDOME/Dancer2-2.2.0/changes"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13577"},{"type":"REPORT","url":"https://github.com/PerlDancer/Dancer2/issues/1807"},{"type":"REPORT","url":"https://github.com/PerlDancer/Dancer2/pull/1804"},{"type":"PACKAGE","url":"https://github.com/PerlDancer/Dancer2"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/perldancer/dancer2","events":[{"introduced":"0"},{"fixed":"9931faa20d48fbd017c500a88f9236a1276c0ea9"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.2.0"},{"fixed":"2.1.0"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"versions":["v2.1.0","v2.0.1","v2.0.0","v1.1.2","v1.1.1","v1.1.0","v1.0.0","v0.400001","v0.301004","v0.301003","v0.301002","v0.301001","v0.301000","v0.300005","v0.300004","v0.300003","v0.300002","v0.300001","v0.300000","v0.208002","v0.208001","v0.208000","v0.207000","v0.206000","v0.206000_02","v0.205002","v0.205001","v0.205000","v0.204004","v0.204003","v0.204002","v0.204001","v0.204000","v0.203001","v0.203000","v0.202000","v0.201000","v0.200004","v0.200003","v0.200002","v0.200001","v0.200000","v0.166001_04","v0.166001_03","v0.166001_02","v0.166001_01","v0.166001","v0.166000","v0.165000","v0.164000","v0.163000","v0.162000_01","v0.162000","v0.161000_01","v0.161000","v0.160003","v0.160002","v0.160000","v0.159003","v0.159002","v0.159001","v0.159000","v0.158000","v0.157001","v0.157000","v0.156001","v0.156000","v0.155004","v0.155003","v0.155002","v0.155001","v0.155000","v0.154000","v0.153002","v0.153001","v0.153000","v0.152000","v0.151000","v0.150000","v0.149000_02","v0.149000_01","v0.143000","v0.142000","v0.141000","v0.140900_01","v0.140001","v0.140000","v0.13","v0.12","v0.11","v0.10","v0.09","v0.08","v0.06","v0.04","v0.03","v0.02","v2.0000_01","v1.9999_02","v1.9999_01"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13577.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"}]}