What is the CVSS score of CVE-2025-15578?

CVE-2025-15578 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Maypole are affected by CVE-2025-15578?

Maypole web application servers (versions 2.10-2.13) are generating predictable session identifiers that attackers can forge to hijack user sessions, potentially gaining unauthorized access to…

How to fix or mitigate CVE-2025-15578?

Within 24 hours: Identify all systems running Maypole 2.10-2.13 and assess exposure; implement network segmentation to restrict Maypole application access. Within 7 days: Deploy compensating controls (WAF rules to detect/block suspicious session patterns, enforce HTTPS with secure session cookies, implement session re-authentication for sensitive operations). Within 30 days: Upgrade to Maypole 2.14 or later when patch becomes available, or migrate to alternative frameworks if vendor patch is not forthcoming.

Maypole CVE-2025-15578

CRITICAL

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)

2026-02-16 9b29abf9-4ab0-4765-b253-1875cd9b441e

Information Disclosure Maypole

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 16, 2026 - 22:22 nvd

CRITICAL 9.8

DescriptionCVE.org

Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely. The session id is seeded with the system time (which is available from HTTP response headers), a call to the built-in rand() function, and the PID.