{"id":"CVE-2025-40926","aliases":["EUVD-2025-208296","GHSA-g98h-c5v8-8m3f"],"status":"published","title":"Plack::Middleware::Session::Simple versions before 0.05 for Perl generates session ids insecurely","description":"Plack::Middleware::Session::Simple versions before 0.05 for Perl generates session ids insecurely.\n\nThe default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.\n\nPredictable session ids could allow an attacker to gain access to systems.\n\nPlack::Middleware::Session::Simple is intended to be compatible with Plack::Middleware::Session, which had a similar security issue CVE-2025-40923.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00503,"percentile":0.43343,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-338","CWE-340"],"published":"2026-03-05T01:24:34Z","modified":"2026-10-28T02:31:07Z","products":[{"vendor":"kazeburo","product":"plack::middleware::session::simple"},{"vendor":"kazeburo","product":"plack\\"}],"references":[{"url":"https://metacpan.org/release/KAZEBURO/Plack-Middleware-Session-Simple-0.04/source/lib/Plack/Middleware/Session/Simple.pm#L43","tags":["Issue Tracking","Product","web"]},{"url":"https://github.com/kazeburo/Plack-Middleware-Session-Simple/pull/4","tags":["issue-tracking","Issue Tracking","Patch","report"]},{"url":"https://github.com/kazeburo/Plack-Middleware-Session-Simple/commit/760bb358b8f53e52cf415888a4ac858fd99bb24e.patch","tags":["patch","Patch","fix"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-40923","tags":["vendor-advisory","related","vdb-entry","Third Party Advisory","advisory"]},{"url":"https://security.metacpan.org/docs/guides/random-data-for-security.html","tags":["technical-description","Third Party Advisory","article"]},{"url":"https://metacpan.org/release/KAZEBURO/Plack-Middleware-Session-Simple-0.05/changes","tags":["release-notes","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40926","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g98h-c5v8-8m3f"},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40926.json","tags":["advisory"]},{"url":"https://github.com/kazeburo/Plack-Middleware-Session-Simple","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-40926","title":"Plack::Middleware::Session::Simple versions before 0.05 for Perl generates session ids insecurely","description":"Plack::Middleware::Session::Simple versions before 0.05 for Perl generates session ids insecurely.\n\nThe default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.\n\nPredictable session ids could allow an attacker to gain access to systems.\n\nPlack::Middleware::Session::Simple is intended to be compatible with Plack::Middleware::Session, which had a similar security issue CVE-2025-40923.","status":"published","published":"2026-03-05T01:24:34.151Z","modified":"2026-04-21T02:42:17.296Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-340","CWE-338"],"updated_at":"2026-11-02T14:32:34.773122Z"}],"euvd":[{"id":"EUVD-2025-208296","description":"Plack::Middleware::Session::Simple versions before 0.05 for Perl generates session ids insecurely.\n\nThe default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.\n\nPredictable session ids could allow an attacker to gain access to systems.\n\nPlack::Middleware::Session::Simple is intended to be compatible with Plack::Middleware::Session, which had a similar security issue CVE-2025-40923.","status":"published","published":"2026-03-05T01:24:34Z","modified":"2026-04-21T02:42:17Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:24:22.012341Z"}],"ghsa":[{"id":"GHSA-g98h-c5v8-8m3f","title":"Plack::Middleware::Session::Simple versions through 0.04 for Perl generates session ids...","description":"Plack::Middleware::Session::Simple versions through 0.04 for Perl generates session ids insecurely.\n\nThe default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.\n\nPredicable session ids could allow an attacker to gain access to systems.\n\nPlack::Middleware::Session::Simple is intended to be compatible with Plack::Middleware::Session, which had a similar security issue CVE-2025-40923.","status":"published","published":"2026-03-05T03:31:26Z","modified":"2026-03-12T00:32:18Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-338"],"updated_at":"2026-11-02T15:06:35.141921Z"}],"nvd":[{"id":"CVE-2025-40926","description":"Plack::Middleware::Session::Simple versions before 0.05 for Perl generates session ids insecurely.\n\nThe default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.\n\nPredictable session ids could allow an attacker to gain access to systems.\n\nPlack::Middleware::Session::Simple is intended to be compatible with Plack::Middleware::Session, which had a similar security issue CVE-2025-40923.","status":"published","published":"2026-03-05T02:16:39.79Z","modified":"2026-06-17T09:22:18.36Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-338","CWE-340"],"updated_at":"2026-11-02T14:12:01.096037Z"}],"osv":[{"id":"CVE-2025-40926","title":"Plack::Middleware::Session::Simple versions before 0.05 for Perl generates session ids insecurely","description":"Plack::Middleware::Session::Simple versions before 0.05 for Perl generates session ids insecurely.\n\nThe default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.\n\nPredictable session ids could allow an attacker to gain access to systems.\n\nPlack::Middleware::Session::Simple is intended to be compatible with Plack::Middleware::Session, which had a similar security issue CVE-2025-40923.","status":"published","published":"2026-03-05T01:24:34.151Z","modified":"2026-10-28T02:31:07.033728591Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-338","CWE-340"],"updated_at":"2026-11-02T15:44:49.394967Z"}]}}