CVE-2026-13082
GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets. The random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a (by default) six-character string. The built-in rand function is unsuitable for security applications because it is predictable and reversible.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.3
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- EPSS probability
- 0.30%
- CWE
- CWE-338, CWE-804
- Published
- 2026-07-17
- Last modified
- 2026-07-17
Affected products
- BURAK GD::SecurityImage
Weakness type
Related vulnerabilities
- CVE-2026-74887 — openssl_encrypt before 1.4.0 Insecure Random Import in PQC Module
- CVE-2026-74874 — openssl_encrypt before 1.4.0 Weak PRNG Steganography Pixel Selection
- CVE-2026-73567 — sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock
- CVE-2026-18611 — Data-science-pipelines-operator: dspo: cryptographically weak secret generation (math/rand) for db and s3 credentials
- CVE-2026-71851 — crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain
- CVE-2026-9205 — Langflow is affected by weaknesses in secret handling and sensitive configuration access
- CVE-2026-64798 — Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension
- CVE-2026-16615 — Librest: weak random number generation in pkce implementation