EUVD-2026-45169
GHSA-p496-rgmp-v9mg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
AV:N and PR:N are clear; AC:H reflects the need to observe multiple CAPTCHA outputs to reconstruct rand() seed before prediction succeeds.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
3DescriptionCVE.org
GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets.
The random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a (by default) six-character string.
The built-in rand function is unsuitable for security applications because it is predictable and reversible.
AnalysisAI
CAPTCHA bypass in GD::SecurityImage through version 1.75 for Perl stems from use of Perl's non-cryptographic rand() function to generate challenge text, making CAPTCHA tokens predictable and reversible by an unauthenticated network attacker. Any Perl web application relying on this library for bot protection is exposed to automated CAPTCHA solving, undermining form submission rate-limiting, account registration guards, and similar defenses. No public exploit code or active exploitation is identified at time of analysis, but the low attack complexity and the clear exploit path make this a practical integrity risk for deployed instances.
Technical ContextAI
GD::SecurityImage (CPE: cpe:2.3:a:burak:gd::securityimage:*:*:*:*:*:*:*:*) is a Perl CPAN module that generates CAPTCHA images for use in web forms. The challenge text - by default a six-character string - is constructed by sampling from a character array using Perl's built-in rand() function. Perl's rand is a pseudo-random number generator (typically a linear congruential or similar deterministic algorithm) that is seeded from predictable sources (commonly the system clock via srand) and produces a fully reversible sequence. CWE-338 (Use of Cryptographically Weak Pseudo-Random Number Generator) is the root cause: rand() lacks the entropy and unpredictability required for security-sensitive token generation. By observing a small set of CAPTCHA outputs, an attacker can recover or approximate the PRNG state and enumerate future tokens, defeating the bot-protection purpose of the CAPTCHA entirely.
RemediationAI
A patch file has been published by the vendor through the MetaCPAN security team at https://security.metacpan.org/patches/G/GD-SecurityImage/1.75/CVE-2026-13082-r1.patch. This patch should be applied to the installed module source. However, a formally released patched CPAN version (e.g., 1.76 or later) has not been independently confirmed from the available references - operators should monitor the CPAN GD::SecurityImage distribution page for an updated release. The fix should replace rand() with a call to a cryptographically secure source such as Crypt::URandom or /dev/urandom-backed generation. As a compensating control where patching is not immediately possible, operators can supplement CAPTCHA with additional bot-protection layers (rate limiting, honeypot fields, IP-based throttling) to raise the cost of automated bypass. Note that these workarounds do not fix the underlying PRNG weakness - they only increase attacker effort. Removing GD::SecurityImage and substituting a maintained CAPTCHA library that uses a CSPRNG is the recommended long-term remediation.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today