What is the CVSS score of CVE-2026-9692?

CVE-2026-9692 has a contested CVSS base score of 5.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-9692?

Yes, a patch is available for CVE-2026-9692. Update the affected software to the latest version immediately.

Mojolicious::Sessions::Storable CVE-2026-9692

EUVD-2026-37926 MEDIUM

Generation of Predictable Numbers or Identifiers (CWE-340)

2026-06-18 CPANSec

GHSA-3m67-fq74-f4qg

Information Disclosure Mojolicious

Medium

Disputed · 5.3 Vendor: CPANSec

Severity by source

Sources disagree (Medium–Critical)

Vendor (CPANSec) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.8 MEDIUM

Predicting SHA-1 from epoch, PID, and heap address requires offline computation and timing correlation, raising AC to H; session forgery enables both read and limited write of session state.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: CPANSec

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 21:16 vuln.today

CVE Published

Jun 18, 2026 - 17:53 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely.

The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, the heap address of an anonymous hash, and the PID.

These are predictable or low-entropy sources that are unsuitable for security purposes.

AnalysisAI

Predictable session ID generation in Mojolicious::Sessions::Storable through version 0.05 for Perl exposes applications to session hijacking. The default session ID generator computes a SHA-1 hash seeded exclusively with low-entropy, attacker-observable sources - Perl's built-in rand function, Unix epoch time, a heap address, and the process ID - none of which meet cryptographic unpredictability requirements for session tokens. No public exploit or active exploitation has been identified (EPSS 0.27%, 19th percentile; not in CISA KEV), but the flaw is automatable per CISA SSVC, meaning a scripted attacker can systematically enumerate candidate session IDs without complex per-target tuning.

Technical ContextAI

The affected component is Mojolicious::Sessions::Storable (CPE: cpe:2.3:a:hayajo:mojolicious::sessions::storable:*:*:*:*:*:*:*:*), a CPAN plugin for the Mojolicious Perl web framework that serializes and stores session data. The root cause is CWE-340 (Generation of Predictable Numbers or Identifiers): SHA-1 is used as a hash function, not a CSPRNG, and its output is only as random as its inputs. Perl's rand() is a deterministic PRNG seeded from the system clock; epoch time and PID are both low-cardinality values guessable within narrow windows; and heap addresses, while partially randomized by ASLR, provide far less entropy than a true random source. An attacker who can observe or approximate request timing can dramatically reduce the search space for valid session tokens. The CPANSec advisory cross-references their own guidance on secure random data for Perl at security.metacpan.org, and a companion CVE (CVE-2025-40923) appears related, suggesting a broader pattern in this library family.

RemediationAI

A vendor-supplied patch is available from CPANSec at https://security.metacpan.org/patches/M/Mojolicious-Plugin-SessionStore/0.05/CVE-2026-9692-r1.patch; this is a patch file against version 0.05, and a fully released post-0.05 package version on CPAN has not been independently confirmed from the available data - check metacpan.org/dist/Mojolicious-Plugin-SessionStore for the latest published release before applying the raw patch. As an immediate compensating control, override the default session ID generator with a cryptographically secure alternative: replace the SHA-1/rand-based generator with one sourced from Perl's Crypt::URandom or equivalent OS-level CSPRNG (/dev/urandom). Disabling session persistence entirely is an extreme but effective fallback if the module cannot be patched and an alternative session backend (e.g., Mojolicious::Plugin::Session with a secure generator) can be substituted. Invalidating all current sessions after patching is advisable, as previously issued IDs were generated insecurely. The CPANSec guidance at https://security.metacpan.org/docs/guides/random-data-for-security.html provides Perl-specific remediation patterns.