EUVD-2026-64663
GHSA-hw54-jvwm-w52c
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Online-only candidate validation and need to infer both session second and worker PID justify AC:H; no authentication or user interaction required for the enumeration attempt itself.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
4DescriptionCVE.org
Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey.
CreateSessionAuthKey runs five rounds of SHA-256, each over a fresh Time::HiRes reading formatted to six decimal places, the running digest, and the process id. CreateSession calls it with an empty key source on every login, and the optional Keysource directive is the only route to the other branch. The result is 64 hex characters. The microsecond field of the first reading takes one of a million values, the later readings follow it within microseconds, and the process id is drawn from a small range.
The key is returned to the browser as the session cookie, and is combined with the configured server key to compute the session id and to encrypt the stored session data. An attacker who knows the second in which a session was created and the process id of the worker that created it can enumerate candidate keys and recover the victim's cookie, bypassing authentication for the protected resources. Each candidate has to be tried against the server, which validates the cookie with a key the attacker does not hold.
AnalysisAI
Session cookie forgery in Apache::AppSamurai::Util through version 1.01 is possible because CreateSessionAuthKey derives its entire entropy from observable runtime state - wall-clock microseconds and the Apache worker process ID - rather than a cryptographically secure random source. An unauthenticated remote attacker who can bound the second in which a target session was created and enumerate the small PID space can construct candidate 64-character hex cookies and recover a valid session token through online brute-force, bypassing authentication for all resources protected by the module. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to bound two observable values: the Unix epoch second in which the victim's session was created, and the process ID of the Apache mod_perl worker that handled the login. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) accurately characterizes the real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched CPAN version has been identified in available data at time of analysis; operators should monitor the PAULDOOM/Apache-AppSamurai release page on metacpan.org and the oss-security thread at https://seclists.org/oss-sec/2026/q3/553 for a fixed release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-341 – Predictable from Observable State
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today