CVE-2025-40919: SALVA Authen::DigestMD5 · Generation of Predictable Numbers or Identifiers
Affects SALVA Authen::DigestMD5Source CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 22% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 16 Jul 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| SALVA Authen::DigestMD5 | Affected
| Fixed in– |
AI-suggested
To mitigate this vulnerability, European organizations should: 1) Upgrade or patch the Authen::DigestMD5 module to a version that uses a cryptographically secure random number generator for cnonce creation, or replace it with alternative authentication modules that comply with RFC 2831 recommendations. 2) If patching is not immediately possible, implement compensating controls such as restricting access to HTTP headers that reveal timing information (e.g., Date header) to reduce predictability. 3) Employ network-level protections like intrusion detection systems to monitor for unusual authentication patterns indicative of replay or impersonation attacks. 4) Conduct code audits and penetration testing focused on authentication mechanisms to identify and remediate similar weaknesses. 5) Educate developers and system administrators on the importance of using cryptographically secure random number generators in security-sensitive contexts. 6) Consider migrating to more modern authentication protocols (e.g., OAuth 2.0, mutual TLS) where feasible to reduce reliance on Digest-MD5.
Description
Authen::DigestMD5 versions 0.01 through 0.02 for Perl generate the cnonce insecurely. The cnonce (client nonce) is generated from an MD5 hash of the PID, the epoch time and the built-in rand function. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. According to RFC 2831, "The cnonce-value is an opaque quoted string value provided by the client and used by both client and server to avoid chosen plaintext attacks, and to provide mutual authentication. The security of the implementation depends on a good choice. It is RECOMMENDED that it contain at least 64 bits of entropy."