EUVD-2026-45896
GHSA-ccc2-34g9-j7rg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Session takeover yields high confidentiality and some integrity but no availability impact; the required missing-CSPRNG configuration plus ID-guessing raises complexity to AC:H, while unauthenticated network reach keeps AV:N/PR:N/UI:N.
Primary rating from Vendor (9b29abf9-4ab0-4765-b253-1875cd9b441e).
CVSS VectorVendor: 9b29abf9-4ab0-4765-b253-1875cd9b441e
Lifecycle Timeline
3DescriptionCVE.org
Dancer2 versions through 2.1.0 for Perl generate insecure session ids when CSPRNG modules are unavailable.
Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id when both Math::Random::ISAAC::XS and Crypt::URandom are unavailable.
The fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function).
These are all low-entropy and easily guessed sources.
The built-in rand() function is seeded with 32-bits and considered unsuitable for security applications.
Predictable session ids could allow an attacker to gain access to systems.
AnalysisAI
Predictable session ID generation in the Dancer2 Perl web framework (all versions through 2.1.0) allows remote attackers to guess valid session identifiers and hijack user sessions. When both the Math::Random::ISAAC::XS and Crypt::URandom CSPRNG modules are absent, Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a SHA-1 hash of low-entropy, largely deterministic inputs (built-in rand(), module path, a counter, PID, an object memory address, and a rand-shuffled string). There is no public exploit identified at time of analysis, KEV lists no active exploitation, and EPSS is low (0.14%), but the flaw is rated CVSS 8.2 and CISA SSVC marks it automatable with partial technical impact.
Technical ContextAI
Dancer2 is a lightweight route-based web application framework for Perl and is the successor to the original Dancer. Session security in web frameworks depends on session identifiers being generated from a cryptographically secure random source so they cannot be predicted or enumerated. Dancer2 normally prefers Math::Random::ISAAC::XS or Crypt::URandom (which draws from the OS CSPRNG), but SessionFactory::generate_id (see lib/Dancer2/Core/Role/SessionFactory.pm around line 142) contains a silent fallback path used when neither module is installed. That fallback derives the ID from Perl's built-in rand() - seeded with only 32 bits and explicitly documented as unsuitable for security - combined with the module's absolute filesystem path, an incrementing counter, the process ID, the object's memory address, and a List::Util::shuffle output (which itself relies on rand()). This is a textbook CWE-338 (Use of Cryptographically Weak PRNG): the entropy is bounded by the 32-bit rand seed and several attacker-inferable constants, so the resulting session tokens are guessable rather than random.
RemediationAI
No specific vendor-released fixed version is identified in the available data (the references point to a source blob at v2.1.0 and an oss-security post, not a tagged patched release), so treat the patched version as not independently confirmed - monitor https://seclists.org/oss-sec/2026/q3/177 and the PerlDancer GitHub project for an updated release and upgrade to it once published. The most effective immediate compensating control is to ensure a CSPRNG backend is installed and loadable so the weak fallback is never reached: install Crypt::URandom and/or Math::Random::ISAAC::XS on every host running the application, which removes the vulnerable code path with essentially no functional side effects. As additional hardening, configure a session engine/cookie settings that bind sessions to additional attributes and rotate/regenerate IDs on privilege change, enforce Secure/HttpOnly cookies and TLS, and invalidate existing sessions after deploying the fix so any previously issued weak IDs cannot be reused.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today