CVE-2026-5082

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5082", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-03-28T19:12:35.387Z", "datePublished": "2026-04-08T05:48:43.633Z", "dateUpdated": "2026-04-08T16:09:26.357Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Amon2-Plugin-Web-CSRFDefender", "product": "Amon2::Plugin::Web::CSRFDefender", "programFiles": ["lib/Amon2/Plugin/Web/CSRFDefender/Random.pm"], "programRoutines": [{"name": "Amon2::Plugin::Web::CSRFDefender::Random::generate_session_id"}], "repo": "https://github.com/tokuhirom/Amon2-Plugin-Web-CSRFDefender", "vendor": "TOKUHIROM", "versions": [{"lessThanOrEqual": "7.03", "status": "affected", "version": "7.00", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Amon2::Plugin::Web::CSRFDefender versions from 7.00 through 7.03 for Perl generate an insecure session id.\n\nThe generate_session_id function will attempt to read bytes from the /dev/urandom device, but if that is unavailable then it generates bytes using SHA-1 hash seeded with the built-in rand() function, the PID, and the high resolution epoch time. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.\n\nAmon2::Plugin::Web::CSRFDefender versions before 7.00 were part of Amon2, which was vulnerable to insecure session ids due to CVE-2025-15604.\n\nNote that the author has deprecated this module."}], "impacts": [{"capecId": "CAPEC-62", "descriptions": [{"lang": "en", "value": "CAPEC-62 Cross Site Request Forgery"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-340", "description": "CWE-340 Generation of Predictable Numbers or Identifiers", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-338", "description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-04-08T05:48:43.633Z"}, "references": [{"url": "https://metacpan.org/release/TOKUHIROM/Amon2-Plugin-Web-CSRFDefender-7.03/source/lib/Amon2/Plugin/Web/CSRFDefender/Random.pm"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/TOKUHIROM/Amon2-Plugin-Web-CSRFDefender-7.04/changes"}, {"tags": ["related", "vendor-advisory"], "url": "https://www.cve.org/CVERecord?id=CVE-2025-15604"}], "solutions": [{"lang": "en", "value": "Upgrade to Amon2::Plugin::Web::CSRFDefender version 7.04 or later."}], "source": {"discovery": "UNKNOWN"}, "title": "Amon2::Plugin::Web::CSRFDefender versions from 7.00 through 7.03 for Perl generate an insecure session id", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-08T16:09:08.752556Z", "id": "CVE-2026-5082", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T16:09:26.357Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-5082", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-08T16:09:08.752556Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T16:09:22.763Z"}}], "cna": {"title": "Amon2::Plugin::Web::CSRFDefender versions from 7.00 through 7.03 for Perl generate an insecure session id", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-62", "descriptions": [{"lang": "en", "value": "CAPEC-62 Cross Site Request Forgery"}]}], "affected": [{"repo": "https://github.com/tokuhirom/Amon2-Plugin-Web-CSRFDefender", "vendor": "TOKUHIROM", "product": "Amon2::Plugin::Web::CSRFDefender", "versions": [{"status": "affected", "version": "7.00", "versionType": "custom", "lessThanOrEqual": "7.03"}], "packageName": "Amon2-Plugin-Web-CSRFDefender", "programFiles": ["lib/Amon2/Plugin/Web/CSRFDefender/Random.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Amon2::Plugin::Web::CSRFDefender::Random::generate_session_id"}]}], "solutions": [{"lang": "en", "value": "Upgrade to Amon2::Plugin::Web::CSRFDefender version 7.04 or later."}], "references": [{"url": "https://metacpan.org/release/TOKUHIROM/Amon2-Plugin-Web-CSRFDefender-7.03/source/lib/Amon2/Plugin/Web/CSRFDefender/Random.pm"}, {"url": "https://metacpan.org/release/TOKUHIROM/Amon2-Plugin-Web-CSRFDefender-7.04/changes", "tags": ["release-notes"]}, {"url": "https://www.cve.org/CVERecord?id=CVE-2025-15604", "tags": ["related", "vendor-advisory"]}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "Amon2::Plugin::Web::CSRFDefender versions from 7.00 through 7.03 for Perl generate an insecure session id.\n\nThe generate_session_id function will attempt to read bytes from the /dev/urandom device, but if that is unavailable then it generates bytes using SHA-1 hash seeded with the built-in rand() function, the PID, and the high resolution epoch time. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.\n\nAmon2::Plugin::Web::CSRFDefender versions before 7.00 were part of Amon2, which was vulnerable to insecure session ids due to CVE-2025-15604.\n\nNote that the author has deprecated this module."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-340", "description": "CWE-340 Generation of Predictable Numbers or Identifiers"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-338", "description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-04-08T05:48:43.633Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5082", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:09:26.357Z", "dateReserved": "2026-03-28T19:12:35.387Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-04-08T05:48:43.633Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Amon2-Plugin-Web-CSRFDefender", "product": "Amon2::Plugin::Web::CSRFDefender", "programFiles": ["lib/Amon2/Plugin/Web/CSRFDefender/Random.pm"], "programRoutines": [{"name": "Amon2::Plugin::Web::CSRFDefender::Random::generate_session_id"}], "repo": "https://github.com/tokuhirom/Amon2-Plugin-Web-CSRFDefender", "vendor": "TOKUHIROM", "versions": [{"lessThanOrEqual": "7.03", "status": "affected", "version": "7.00", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tokuhirom:amon2\\:\\:plugin\\:\\:web\\:\\:csrfdefender:*:*:*:*:*:perl:*:*", "matchCriteriaId": "9976BCB7-13C5-4F44-A248-29D54E13E64E", "versionEndIncluding": "7.03", "versionStartIncluding": "7.00", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Amon2::Plugin::Web::CSRFDefender versions from 7.00 through 7.03 for Perl generate an insecure session id.\n\nThe generate_session_id function will attempt to read bytes from the /dev/urandom device, but if that is unavailable then it generates bytes using SHA-1 hash seeded with the built-in rand() function, the PID, and the high resolution epoch time. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.\n\nAmon2::Plugin::Web::CSRFDefender versions before 7.00 were part of Amon2, which was vulnerable to insecure session ids due to CVE-2025-15604.\n\nNote that the author has deprecated this module."}, {"lang": "es", "value": "Las versiones de Amon2::Plugin::Web::CSRFDefender de la 7.00 a la 7.03 para Perl generan un ID de sesi\u00f3n inseguro.\n\nLa funci\u00f3n generate_session_id intentar\u00e1 leer bytes del dispositivo /dev/urandom, pero si este no est\u00e1 disponible, entonces genera bytes usando un hash SHA-1 inicializado con la funci\u00f3n rand() incorporada, el PID y el tiempo de \u00e9poca de alta resoluci\u00f3n. El PID provendr\u00e1 de un peque\u00f1o conjunto de n\u00fameros, y el tiempo de \u00e9poca puede ser adivinado, si no se filtra del encabezado HTTP Date. La funci\u00f3n rand incorporada no es adecuada para uso criptogr\u00e1fico.\n\nLas versiones de Amon2::Plugin::Web::CSRFDefender anteriores a la 7.00 formaban parte de Amon2, el cual era vulnerable a IDs de sesi\u00f3n inseguros debido a CVE-2025-15604.\n\nTenga en cuenta que el autor ha desaprobado este m\u00f3dulo."}], "id": "CVE-2026-5082", "lastModified": "2026-07-24T20:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5082", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-08T16:09:08.752556Z", "version": "2.0.3"}}]}, "published": "2026-04-08T06:16:28.993", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Product"], "url": "https://metacpan.org/release/TOKUHIROM/Amon2-Plugin-Web-CSRFDefender-7.03/source/lib/Amon2/Plugin/Web/CSRFDefender/Random.pm"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Release Notes"], "url": "https://metacpan.org/release/TOKUHIROM/Amon2-Plugin-Web-CSRFDefender-7.04/changes"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Third Party Advisory"], "url": "https://www.cve.org/CVERecord?id=CVE-2025-15604"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-338"}, {"lang": "en", "value": "CWE-340"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[7.00,7.03]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Amon2::Plugin::Web::CSRFDefender", "source": "cna", "vendor": "TOKUHIROM"}, "product": "amon2::plugin::web::csrfdefender", "vendor": "tokuhirom"}], "analysis": {"en": {"generated_at": "2026-04-08T17:52:05.338063+00:00", "value": {"mitigation_remediation": ["Upgrade to Amon2::Plugin::Web::CSRFDefender version 7.04 or later.", "If an upgrade is not immediately feasible, verify that /dev/urandom is accessible on the host; ensure the server can read from it.", "Consider disabling or replacing the CSRFDefender module with a vetted CSRF protection library.", "Audit session management configuration for other weak entropy sources and enforce secure random generators.", "Monitor user sessions for suspicious activity such as unexpected logins or session anomalies."], "summary": {"action": "Apply Patch", "impact": "Insecure session identifier leading to possible session hijacking"}, "threat_synthesis": {"affected_systems": "Vulnerable software is the TOKUHIROM Amon2::Plugin::Web::CSRFDefender module for Perl, versions 7.00 through 7.03 inclusive. These versions are part of the Amon2 web framework and have been deprecated by the author. Systems running any of these releases are susceptible to the insecure session ID flaw.", "description_and_impact": "The vulnerability arises from the generate_session_id function, which uses low\u2011entropy sources when /dev/urandom is unavailable. The resulting session identifiers are predictable, allowing an attacker to guess or reproduce a session ID and impersonate a legitimate user. This compromise can lead to unauthorized access, session hijacking, and potentially full compromise of the web application. The weakness is a cryptographic random number generation fault, reflected in CWE\u2011338 and CWE\u2011340.", "risk_and_exploitability": "The CVSS base score of 5.3 indicates a moderate impact, while the EPSS score of less than 1% suggests low exploitation likelihood in the wild. The vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation would typically be carried out remotely against the web application, requiring limited prerequisites beyond the presence of an inconsistent random source. Attackers could read HTTP headers such as Date to narrow the epoch and use predictable DST to reconstruct the ID."}}}}, "created": "2026-04-08T19:31:17.449910+00:00", "updated": "2026-04-08T19:43:52.031600+00:00", "vendors": ["tokuhirom", "tokuhirom$PRODUCT$amon2::plugin::web::csrfdefender"]}