CVE-2026-5087
PAGI::Middleware::Session::Store::Cookie versions through 0.001003 for Perl generates random bytes insecurely. PAGI::Middleware::Session::Store::Cookie attempts to read bytes from the /dev/urandom device directly. If that fails (for example, on systems without the device, such as Windows), then it will emit a warning that recommends the user install Crypt::URandom, and then return a string of random bytes generated by the built-in rand function, which is unsuitable for cryptographic applications. This modules does not use the Crypt::URandom module, and installing it will not fix the problem. The random bytes are used for generating an initialisation vector (IV) to encrypt the cookie. A predictable IV may make it easier for malicious users to decrypt and tamper with the session data that is stored in the cookie.
Scoring
- CVSS base score
- 0
- EPSS probability
- 0.32%
- CWE
- CWE-338, CWE-1204
- Published
- 2026-03-31
- Last modified
- 2026-03-31
Affected products
- JJNAPIORK PAGI::Middleware::Session::Store::Cookie
Weakness type
Related vulnerabilities
- CVE-2026-74887 — openssl_encrypt before 1.4.0 Insecure Random Import in PQC Module
- CVE-2026-74874 — openssl_encrypt before 1.4.0 Weak PRNG Steganography Pixel Selection
- CVE-2026-73567 — sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock
- CVE-2026-18611 — Data-science-pipelines-operator: dspo: cryptographically weak secret generation (math/rand) for db and s3 credentials
- CVE-2026-71851 — crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain
- CVE-2026-9205 — Langflow is affected by weaknesses in secret handling and sensitive configuration access
- CVE-2026-64798 — Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension
- CVE-2026-16615 — Librest: weak random number generation in pkce implementation