# CVE-2026-5087

## Summary

- **CVE ID:** CVE-2026-5087
- **Severity:** UNKNOWN
- **CVSS Score:** 0
- **CWE:** CWE-338, CWE-1204
- **Published:** Mar 31, 2026
- **Last Modified:** Mar 31, 2026

## Description

PAGI::Middleware::Session::Store::Cookie versions through 0.001003 for Perl generates random bytes insecurely.

PAGI::Middleware::Session::Store::Cookie attempts to read bytes from the /dev/urandom device directly. If that fails (for example, on systems without the device, such as Windows), then it will emit a warning that recommends the user install Crypt::URandom, and then return a string of random bytes generated by the built-in rand function, which is unsuitable for cryptographic applications.

This modules does not use the Crypt::URandom module, and installing it will not fix the problem.

The random bytes are used for generating an initialisation vector (IV) to encrypt the cookie.

A predictable IV may make it easier for malicious users to decrypt and tamper with the session data that is stored in the cookie.

## Affected Products

- JJNAPIORK — PAGI::Middleware::Session::Store::Cookie (0)

## References

- [CNA](https://metacpan.org/release/JJNAPIORK/PAGI-Middleware-Session-Store-Cookie-0.001003/source/lib/PAGI/Middleware/Session/Store/Cookie.pm#L156-173)
- [CNA](https://metacpan.org/release/JJNAPIORK/PAGI-Middleware-Session-Store-Cookie-0.001004/changes)
- [CVE](http://www.openwall.com/lists/oss-security/2026/03/31/10)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.32%
- **EPSS Percentile:** 24.2

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-11._