CVE-2026-5082

The record

Amon2::Plugin::Web::CSRFDefender versions from 7.00 through 7.03 for Perl generate an insecure session id. The generate_session_id function will attempt to read bytes from the /dev/urandom device, but if that is unavailable then it generates bytes using SHA-1 hash seeded with the built-in rand() function, the PID, and the high resolution epoch time. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Amon2::Plugin::Web::CSRFDefender versions before 7.00 were part of Amon2, which was vulnerable to insecure session ids due to CVE-2025-15604. Note that the author has deprecated this module.

Affected packages

Related vulnerabilities

• CVE-2026-74887 openssl_encrypt before 1.4.0 imports Python's non-cryptographic 'random' module (Mersenne… CWE-338
• CVE-2026-71851 crypto-js is a JavaScript library of crypto standards. CWE-338
• CVE-2026-16615 A flaw was found in librest. CWE-338
• CVE-2026-14495 The DoLogin Security plugin for WordPress is vulnerable to Authentication Bypass via… CWE-338
• CVE-2026-7830 UltraVNC through 1.8.2.2 uses inadequate cryptography in the MS-Logon II authentication… CWE-338
• CVE-2026-44040 UltraVNC through 1.8.2.2 uses a cryptographically weak pseudo-random number generator to… CWE-338
• CVE-2026-9733 Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure… CWE-338
• CVE-2026-56141 In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120… CWE-338