What is the CVSS score of CVE-2026-2439?

CVE-2026-2439 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Concierge are affected by CVE-2026-2439?

Concierge::Sessions versions 0.8.1-0.8.4 generate cryptographically weak session identifiers, allowing attackers to predict and hijack user sessions.. A patch is available.

How to fix or mitigate CVE-2026-2439?

Within 24 hours: Inventory all systems running Concierge::Sessions and identify affected versions. Within 7 days: Apply patch to upgrade to version 0.8.5 or later across all production and non-production environments. Within 30 days: Invalidate all existing sessions, force user re-authentication, and review access logs for suspicious activity during the vulnerability window.

Concierge CVE-2026-2439

CRITICAL

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)

2026-02-16 9b29abf9-4ab0-4765-b253-1875cd9b441e

Information Disclosure Concierge

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Mar 10, 2026 - 18:12 nvd

Patch available

CVE Published

Feb 16, 2026 - 22:22 nvd

CRITICAL 9.8

DescriptionCVE.org

Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids. The generate_session_id function in Concierge::Sessions::Base defaults to using the uuidgen command to generate a UUID, with a fallback to using Perl's built-in rand function. Neither of these methods are secure, and attackers are able to guess session_ids that can grant them access to systems. Specifically,

There is no warning when uuidgen fails. The software can be quietly using the fallback rand() function with no warnings if the command fails for any reason.
The uuidgen command will generate a time-based UUID if the system does not have a high-quality random number source, because the call does not explicitly specify the --random option. Note that the system time is shared in HTTP responses.
UUIDs are identifiers whose mere possession grants access, as per RFC 9562.
The output of the built-in rand() function is predictable and unsuitable for security applications.