CVE-2026-2439

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2439", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-02-12T23:47:52.767Z", "datePublished": "2026-02-16T21:25:21.091Z", "dateUpdated": "2026-02-17T14:45:00.408Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Concierge-Sessions", "product": "Concierge::Sessions", "programFiles": ["lib/Concierge/Sessions/Base.pm"], "repo": "https://github.com/bwva/Concierge-Sessions", "vendor": "BVA", "versions": [{"lessThan": "0.8.5", "status": "affected", "version": "0.8.1", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Robert Rothenberg"}], "descriptions": [{"lang": "en", "value": "Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids. The generate_session_id function in Concierge::Sessions::Base defaults to using the uuidgen command to generate a UUID, with a fallback to using Perl's built-in rand function. Neither of these methods are secure, and attackers are able to guess session_ids that can grant them access to systems. Specifically,\n\n * There is no warning when uuidgen fails. The software can be quietly using the fallback rand() function with no warnings if the command fails for any reason.\n * The uuidgen command will generate a time-based UUID if the system does not have a high-quality random number source, because the call does not explicitly specify the --random option. Note that the system time is shared in HTTP responses.\n * UUIDs are identifiers whose mere possession grants access, as per RFC 9562.\n * The output of the built-in rand() function is predictable and unsuitable for security applications."}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-340", "description": "CWE-340 Generation of Predictable Numbers or Identifiers", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-338", "description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-02-16T21:25:21.091Z"}, "references": [{"tags": ["related"], "url": "https://metacpan.org/release/BVA/Concierge-Sessions-v0.8.4/diff/BVA/Concierge-Sessions-v0.8.5#lib/Concierge/Sessions/Base.pm"}, {"tags": ["related"], "url": "https://security.metacpan.org/docs/guides/random-data-for-security.html"}, {"tags": ["related"], "url": "https://www.rfc-editor.org/rfc/rfc9562.html#name-security-considerations"}, {"tags": ["related"], "url": "https://perldoc.perl.org/5.42.0/functions/rand"}, {"tags": ["patch"], "url": "https://github.com/bwva/Concierge-Sessions/commit/20bb28e92e8fba307c4ff8264701c215be65e73b"}], "solutions": [{"lang": "en", "value": "Upgrade to Concierge::Sessions v0.8.5 or later."}], "source": {"discovery": "UNKNOWN"}, "title": "Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-02-17T14:44:27.594037Z", "id": "CVE-2026-2439", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T14:45:00.408Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-2439", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-17T14:44:27.594037Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T14:44:55.452Z"}}], "cna": {"title": "Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Robert Rothenberg"}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "affected": [{"repo": "https://github.com/bwva/Concierge-Sessions", "vendor": "BVA", "product": "Concierge::Sessions", "versions": [{"status": "affected", "version": "0.8.1", "lessThan": "0.8.5", "versionType": "custom"}], "packageName": "Concierge-Sessions", "programFiles": ["lib/Concierge/Sessions/Base.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to Concierge::Sessions v0.8.5 or later."}], "references": [{"url": "https://metacpan.org/release/BVA/Concierge-Sessions-v0.8.4/diff/BVA/Concierge-Sessions-v0.8.5#lib/Concierge/Sessions/Base.pm", "tags": ["related"]}, {"url": "https://security.metacpan.org/docs/guides/random-data-for-security.html", "tags": ["related"]}, {"url": "https://www.rfc-editor.org/rfc/rfc9562.html#name-security-considerations", "tags": ["related"]}, {"url": "https://perldoc.perl.org/5.42.0/functions/rand", "tags": ["related"]}, {"url": "https://github.com/bwva/Concierge-Sessions/commit/20bb28e92e8fba307c4ff8264701c215be65e73b", "tags": ["patch"]}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids. The generate_session_id function in Concierge::Sessions::Base defaults to using the uuidgen command to generate a UUID, with a fallback to using Perl's built-in rand function. Neither of these methods are secure, and attackers are able to guess session_ids that can grant them access to systems. Specifically,\n\n * There is no warning when uuidgen fails. The software can be quietly using the fallback rand() function with no warnings if the command fails for any reason.\n * The uuidgen command will generate a time-based UUID if the system does not have a high-quality random number source, because the call does not explicitly specify the --random option. Note that the system time is shared in HTTP responses.\n * UUIDs are identifiers whose mere possession grants access, as per RFC 9562.\n * The output of the built-in rand() function is predictable and unsuitable for security applications."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-340", "description": "CWE-340 Generation of Predictable Numbers or Identifiers"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-338", "description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-02-16T21:25:21.091Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2439", "state": "PUBLISHED", "dateUpdated": "2026-02-17T14:45:00.408Z", "dateReserved": "2026-02-12T23:47:52.767Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-02-16T21:25:21.091Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Concierge-Sessions", "product": "Concierge::Sessions", "programFiles": ["lib/Concierge/Sessions/Base.pm"], "repo": "https://github.com/bwva/Concierge-Sessions", "vendor": "BVA", "versions": [{"lessThan": "0.8.5", "status": "affected", "version": "0.8.1", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:bva:concierge\\:\\:sessions:*:*:*:*:*:perl:*:*", "matchCriteriaId": "CDB9F71D-07E7-4EF3-8C7A-BF35F9175DB9", "versionEndExcluding": "0.8.5", "versionStartIncluding": "0.8.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids. The generate_session_id function in Concierge::Sessions::Base defaults to using the uuidgen command to generate a UUID, with a fallback to using Perl's built-in rand function. Neither of these methods are secure, and attackers are able to guess session_ids that can grant them access to systems. Specifically,\n\n * There is no warning when uuidgen fails. The software can be quietly using the fallback rand() function with no warnings if the command fails for any reason.\n * The uuidgen command will generate a time-based UUID if the system does not have a high-quality random number source, because the call does not explicitly specify the --random option. Note that the system time is shared in HTTP responses.\n * UUIDs are identifiers whose mere possession grants access, as per RFC 9562.\n * The output of the built-in rand() function is predictable and unsuitable for security applications."}, {"lang": "es", "value": "Las versiones de Concierge::Sessions desde la 0.8.1 anteriores a la 0.8.5 para Perl generan identificadores de sesi\u00f3n inseguros. La funci\u00f3n generate_session_id en Concierge::Sessions::Base por defecto utiliza el comando uuidgen para generar un UUID, con un mecanismo de respaldo que usa la funci\u00f3n rand incorporada de Perl. Ninguno de estos m\u00e9todos es seguro, y los atacantes pueden adivinar los identificadores de sesi\u00f3n que pueden otorgarles acceso a los sistemas. Espec\u00edficamente,\n\n * No hay ninguna advertencia cuando uuidgen falla. El software puede estar utilizando silenciosamente la funci\u00f3n de respaldo rand() sin advertencias si el comando falla por cualquier motivo.\n * El comando uuidgen generar\u00e1 un UUID basado en el tiempo si el sistema no tiene una fuente de n\u00fameros aleatorios de alta calidad, porque la llamada no especifica expl\u00edcitamente la opci\u00f3n --random. Tenga en cuenta que la hora del sistema se comparte en las respuestas HTTP.\n * Los UUID son identificadores cuya mera posesi\u00f3n otorga acceso, seg\u00fan la RFC 9562.\n * La salida de la funci\u00f3n rand() incorporada es predecible e inadecuada para aplicaciones de seguridad."}], "id": "CVE-2026-2439", "lastModified": "2026-06-17T10:30:57.400", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2439", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-17T14:44:27.594037Z", "version": "2.0.3"}}]}, "published": "2026-02-16T22:22:41.470", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Patch"], "url": "https://github.com/bwva/Concierge-Sessions/commit/20bb28e92e8fba307c4ff8264701c215be65e73b"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Product", "Release Notes"], "url": "https://metacpan.org/release/BVA/Concierge-Sessions-v0.8.4/diff/BVA/Concierge-Sessions-v0.8.5#lib/Concierge/Sessions/Base.pm"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Third Party Advisory"], "url": "https://perldoc.perl.org/5.42.0/functions/rand"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Third Party Advisory"], "url": "https://security.metacpan.org/docs/guides/random-data-for-security.html"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Third Party Advisory"], "url": "https://www.rfc-editor.org/rfc/rfc9562.html#name-security-considerations"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-338"}, {"lang": "en", "value": "CWE-340"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.8.1,0.8.5)"}}], "product": "concierge::sessions", "vendor": "bva"}], "analysis": {"en": {"generated_at": "2026-04-17T18:59:21.192952+00:00", "value": {"mitigation_remediation": ["Upgrade Concierge::Sessions to v0.8.5 or later, which replaces insecure generation logic with a cryptographically secure source.", "Verify that uuidgen is available and executed with the --random flag, or configure the module to use a secure random generator such as Crypt::URandom, to eliminate reliance on time\u2011based or deterministic values.", "Disable or enforce error handling on uuidgen failures by patching generate_session_id so that the process aborts instead of falling back to rand(); this serves as a temporary protection until the library upgrade can be deployed."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized session hijacking via predictable session IDs"}, "threat_synthesis": {"affected_systems": "The affected product is BVA\u2019s Concierge::Sessions library versions older than 0.8.5, as listed by the CNA. No other vendors or products are cited, so the impact is limited to applications that depend on this module.", "description_and_impact": "Concierge::Sessions, a Perl module for generating session identifiers, exposes insecure IDs in releases 0.8.1 through 0.8.4. The generate_session_id routine first invokes the uuidgen command and, on failure, silently falls back to Perl\u2019s rand() function. Neither mechanism provides cryptographic randomness: uuidgen without the --random switch generates time\u2011based UUIDs that embed the system clock, and Perl\u2019s rand() is deterministic once seeded, enabling attackers to predict or brute\u2011force session identifiers that serve as full access tokens.", "risk_and_exploitability": "The CVSS score of 9.8 marks this flaw as a high\u2011severity remote vulnerability, while the EPSS score of less than 1% indicates that exploitation is expected to remain low at the time of analysis. Despite this, the lack of a warning when uuidgen fails and the use of a predictable fallback let attackers potentially generate legitimate session IDs, effectively bypassing authentication. The combination of a top\u2011tier severity and an exploitable session hijack scenario demands vigilant monitoring and prompt remediation."}}}}, "created": "2026-02-17T08:48:57.908612+00:00", "updated": "2026-04-17T19:00:11.064100+00:00", "vendors": ["bva", "bva$PRODUCT$concierge::sessions"]}