What is the CVSS score of EUVD-2026-31332?

EUVD-2026-31332 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Authen::TOTP are affected by EUVD-2026-31332?

Organizations using the Authen::TOTP Perl module (before version 0.1.1) for two-factor authentication have fundamentally weakened account security due to reliance on non-cryptographic randomization…. A patch is available.

How to fix or mitigate EUVD-2026-31332?

Within 24 hours, identify all applications and services using the Authen::TOTP Perl module by querying package repositories and application inventories; assess business criticality of affected systems. Within 7 days, source version 0.1.1 from CPAN or your package distribution system, validate compatibility in development environments, and plan staged deployment by system criticality. Within 30 days, complete migration of all affected applications to Authen::TOTP 0.1.1 or later and verify successful deployment across your infrastructure.

Authen::TOTP EUVD-2026-31332

| CVE-2026-46473 HIGH

Insufficient Entropy (CWE-331)

2026-05-21 CPANSec

GHSA-wm67-cj4w-p69m

Information Disclosure Authen

7.5

CVSS 3.1 · Vendor: CPANSec

Severity by source

Vendor (CPANSec) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.9 MEDIUM

AC:H because an attacker must reconstruct Perl rand() state and target a specific account; PR:N/UI:N as no auth or interaction is needed, and impact is limited to secret confidentiality (C:H).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CPANSec).

CVSS VectorVendor: CPANSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 17:26 vuln.today

Analysis Generated

Jul 23, 2026 - 17:26 vuln.today

CVE Published

May 21, 2026 - 18:53 cve.org

HIGH 7.5

CVE Published

May 21, 2026 - 18:53 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Authen::TOTP versions before 0.1.1 for Perl generate secrets using rand.

Secrets were generated using Perl's built-in rand function, which is predictable and unsuitable for security usage.

AnalysisAI

Weak secret generation in the Authen::TOTP Perl module before version 0.1.1 lets attackers predict TOTP shared secrets because they were built with Perl's non-cryptographic rand() function. Any application relying on this module to seed two-factor authentication produces guessable secrets, undermining the OTP protection it was meant to provide. There is no public exploit identified at time of analysis, and EPSS rates near-zero (0.01%) exploitation probability, but the fix (0.1.1) is confirmed in the vendor changelog.

Technical ContextAI

Authen::TOTP implements RFC 6238 time-based one-time passwords for Perl applications, and its gen_secret() routine originally assembled the shared secret character-by-character from Perl's built-in rand(). Perl's rand() is a general-purpose pseudo-random generator that is deterministic once its seed/internal state is known and is explicitly documented as unsuitable for cryptography - the classic realization of CWE-331 (Insufficient Entropy). Because the TOTP secret is the sole cryptographic seed shared between server and authenticator, low entropy there directly translates to predictable OTP values. The single affected package is identified by CPE cpe:2.3:a:tchatzi:authen::totp, and the patch (commit d04f30c) replaces the loop with Crypt::PRNG::random_string_from(), a CSPRNG-backed routine.

RemediationAI

Upgrade to Authen::TOTP 0.1.1 or later - Vendor-released patch: 0.1.1, which replaces rand() with Crypt::PRNG::random_string_from() and adds a Crypt::PRNG dependency (see the changelog at https://metacpan.org/release/TCHATZI/Authen-TOTP-0.1.1/changes and the fix commit https://github.com/tchatzi/Authen-TOTP/commit/d04f30cc6538d77fc6b6d550da450cf3017b8561). Critically, upgrading alone does not remediate existing accounts: any TOTP secret generated by a version before 0.1.1 remains weak and must be regenerated and re-enrolled after upgrading, forcing affected users to re-provision their authenticator app. As an interim compensating control if you cannot upgrade immediately, generate secrets outside the module using a CSPRNG (e.g., Crypt::PRNG or /dev/urandom) and pass them in, and consider layering an additional authentication factor or rate-limiting/lockout on OTP validation to blunt any brute-force or prediction attempts; the trade-off is added enrollment and operational complexity.