CVE-2026-5085

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5085", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-03-28T19:20:25.997Z", "datePublished": "2026-04-13T06:56:14.964Z", "dateUpdated": "2026-04-13T15:30:06.627Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Solstice", "product": "Solstice::Session", "programFiles": ["lib/Solstice/Session.pm", "lib/Solstice/Subsession.pm"], "programRoutines": [{"name": "Solstice::Session::_generateSessionID"}, {"name": "Solstice::Subsession::_generateID"}], "vendor": "MCRAWFOR", "versions": [{"lessThanOrEqual": "1440", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Solstice::Session versions through 1440 for Perl generates session ids insecurely.\n\nThe _generateSessionID method returns an MD5 digest seeded by the epoch time, a random hash reference, a call to the built-in rand() function and the process id.\n\nThe same method is used in the _generateID method in Solstice::Subsession, which is part of the same distribution.\n\nThe epoch time may be guessed, if it is not leaked in the HTTP Date header. Stringified hash refences will contain predictable content. The built-in rand() function is seeded by 16-bits and is unsuitable for security purposes. The process id comes from a small set of numbers.\n\nPredictable session ids could allow an attacker to gain access to systems."}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-340", "description": "CWE-340 Generation of Predictable Numbers or Identifiers", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-338", "description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-04-13T06:56:14.964Z"}, "references": [{"url": "https://metacpan.org/dist/Solstice/source/lib/Solstice/Session.pm#L481"}, {"url": "https://metacpan.org/dist/Solstice/source/lib/Solstice/Subsession.pm#L105"}, {"tags": ["technical-description"], "url": "https://security.metacpan.org/docs/guides/random-data-for-security.html"}], "source": {"discovery": "UNKNOWN"}, "title": "Solstice::Session versions through 1440 for Perl generates session ids insecurely", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-13T14:27:45.409795Z", "id": "CVE-2026-5085", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-13T14:29:29.087Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/04/13/2"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-04-13T15:30:06.627Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/04/13/2"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-04-13T15:30:06.627Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-5085", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-13T14:27:45.409795Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-13T14:26:58.491Z"}}], "cna": {"title": "Solstice::Session versions through 1440 for Perl generates session ids insecurely", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "affected": [{"vendor": "MCRAWFOR", "product": "Solstice::Session", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1440"}], "packageName": "Solstice", "programFiles": ["lib/Solstice/Session.pm", "lib/Solstice/Subsession.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Solstice::Session::_generateSessionID"}, {"name": "Solstice::Subsession::_generateID"}]}], "references": [{"url": "https://metacpan.org/dist/Solstice/source/lib/Solstice/Session.pm#L481"}, {"url": "https://metacpan.org/dist/Solstice/source/lib/Solstice/Subsession.pm#L105"}, {"url": "https://security.metacpan.org/docs/guides/random-data-for-security.html", "tags": ["technical-description"]}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "Solstice::Session versions through 1440 for Perl generates session ids insecurely.\n\nThe _generateSessionID method returns an MD5 digest seeded by the epoch time, a random hash reference, a call to the built-in rand() function and the process id.\n\nThe same method is used in the _generateID method in Solstice::Subsession, which is part of the same distribution.\n\nThe epoch time may be guessed, if it is not leaked in the HTTP Date header. Stringified hash refences will contain predictable content. The built-in rand() function is seeded by 16-bits and is unsuitable for security purposes. The process id comes from a small set of numbers.\n\nPredictable session ids could allow an attacker to gain access to systems."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-340", "description": "CWE-340 Generation of Predictable Numbers or Identifiers"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-338", "description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-04-13T06:56:14.964Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5085", "state": "PUBLISHED", "dateUpdated": "2026-04-13T15:30:06.627Z", "dateReserved": "2026-03-28T19:20:25.997Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-04-13T06:56:14.964Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Solstice", "product": "Solstice::Session", "programFiles": ["lib/Solstice/Session.pm", "lib/Solstice/Subsession.pm"], "programRoutines": [{"name": "Solstice::Session::_generateSessionID"}, {"name": "Solstice::Subsession::_generateID"}], "vendor": "MCRAWFOR", "versions": [{"lessThanOrEqual": "1440", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mcrawfor:solstice\\:\\:session:1440:*:*:*:*:perl:*:*", "matchCriteriaId": "83F100D9-D72B-48D9-9D4A-C1C47B9D19CF", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Solstice::Session versions through 1440 for Perl generates session ids insecurely.\n\nThe _generateSessionID method returns an MD5 digest seeded by the epoch time, a random hash reference, a call to the built-in rand() function and the process id.\n\nThe same method is used in the _generateID method in Solstice::Subsession, which is part of the same distribution.\n\nThe epoch time may be guessed, if it is not leaked in the HTTP Date header. Stringified hash refences will contain predictable content. The built-in rand() function is seeded by 16-bits and is unsuitable for security purposes. The process id comes from a small set of numbers.\n\nPredictable session ids could allow an attacker to gain access to systems."}, {"lang": "es", "value": "Las versiones de Solstice::Session hasta la 1440 para Perl generan identificadores de sesi\u00f3n de forma insegura.\n\nEl m\u00e9todo _generateSessionID devuelve un resumen MD5 inicializado con el tiempo de \u00e9poca, una referencia de hash aleatoria, una llamada a la funci\u00f3n rand() incorporada y el ID de proceso.\n\nEl mismo m\u00e9todo se utiliza en el m\u00e9todo _generateID en Solstice::Subsession, que forma parte de la misma distribuci\u00f3n.\n\nEl tiempo de \u00e9poca puede ser adivinado, si no se filtra en el encabezado de fecha HTTP. Las referencias de hash convertidas a cadena contendr\u00e1n contenido predecible. La funci\u00f3n rand() incorporada se inicializa con 16 bits y no es adecuada para fines de seguridad. El ID de proceso proviene de un peque\u00f1o conjunto de n\u00fameros.\n\nLos identificadores de sesi\u00f3n predecibles podr\u00edan permitir a un atacante obtener acceso a los sistemas."}], "id": "CVE-2026-5085", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5085", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-13T14:27:45.409795Z", "version": "2.0.3"}}]}, "published": "2026-04-13T07:16:50.543", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Product"], "url": "https://metacpan.org/dist/Solstice/source/lib/Solstice/Session.pm#L481"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Product"], "url": "https://metacpan.org/dist/Solstice/source/lib/Solstice/Subsession.pm#L105"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Third Party Advisory"], "url": "https://security.metacpan.org/docs/guides/random-data-for-security.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "http://www.openwall.com/lists/oss-security/2026/04/13/2"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-338"}, {"lang": "en", "value": "CWE-340"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1440]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Solstice::Session", "source": "cna", "vendor": "MCRAWFOR"}, "product": "solstice::session", "vendor": "mcrawfor"}], "analysis": {"en": {"generated_at": "2026-04-13T16:51:22.936367+00:00", "value": {"mitigation_remediation": ["Replace the vulnerable _generateSessionID logic with a cryptographically secure random generator, such as Perl's Crypt::Secure::Random or Data::UUID, to construct session identifiers.", "Ensure that session identifiers are only transmitted over HTTPS and that they are not logged or exposed in referrer headers or URLs.", "Regenerate session identifiers upon each successful authentication and periodically rotate them to limit the window of opportunity for an attacker.", "If a newer release of Solstice::Session is released that addresses the issue, upgrade to that version as soon as possible."], "summary": {"action": "Mitigate", "impact": "Session hijacking via predictable session IDs"}, "threat_synthesis": {"affected_systems": "All releases of the Solstice::Session module up to and including version 1440 distributed by MCRAWFOR on CPAN are affected. The Solstice::Subsession module, which shares the same token generation logic, is also vulnerable. Applications that rely on these modules for session handling are at risk, and no later release is documented that resolves the issue.", "description_and_impact": "The _generateSessionID method in Solstice::Session and its counterpart in Solstice::Subsession produce session identifiers by concatenating the current epoch time, a stringified hash reference, the built\u2011in rand() function, and the process ID, then hashing the result with MD5. Because the epoch time can be guessed, the hash reference is deterministic, rand() provides only 16 bits of entropy, and process IDs are drawn from a small set, the resulting token is highly predictable. This weakness enables an attacker to guess valid session identifiers and impersonate legitimate users, thereby gaining unauthorized access to protected resources. The flaw falls under the weaknesses of predictable random number generation (CWE\u2011338) and inadequate entropy sources (CWE\u2011340).", "risk_and_exploitability": "The CVSS score of 9.1 classifies the vulnerability as critical, indicating that successful exploitation results in full system compromise. The EPSS score of less than 1% suggests that, at present, the likelihood of exploitation is low, but the high severity still demands attention. The flaw does not appear in the CISA Known Exploited Vulnerabilities catalog, implying no publicly documented exploits yet. A likely attack vector is a remote network attacker who can observe or guess session identifiers transmitted in cookies or URLs. Because the token is based on components that can be predicted or brute\u2011forced, an attacker can attempt to guess a valid session ID with minimal effort, especially if the HTTP Date header exposes the epoch time or if the application logs session IDs in a way that is readable to the attacker. Successful guessing would allow session hijacking and full access to the victim's privileged state."}}}}, "created": "2026-04-13T12:36:51.381672+00:00", "updated": "2026-04-14T16:35:22.510370+00:00", "vendors": ["mcrawfor", "mcrawfor$PRODUCT$solstice::session"]}