CVE-2025-40933: KGOLDOV Apache::AuthAny · Generation of Predictable Numbers or Identifiers
Affects KGOLDOV Apache::AuthAnySource CVE Database V5
Not known to be exploited · CVSS 7.5 High.
Data as of 26 Oct 2026, 15:59 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 35% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 17 Sep 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| KGOLDOV Apache::AuthAny | Affected
| Fixed in– |
AI-suggested
Organizations should immediately audit their use of the Apache::AuthAny::Cookie module, especially versions 0.201 or earlier. The primary mitigation is to upgrade to a patched version of the module once available or replace the session ID generation mechanism with a cryptographically secure pseudorandom number generator (CSPRNG), such as those provided by Perl modules like Crypt::Random or using system-level entropy sources. Avoid reliance on predictable inputs like epoch time and the built-in rand() function for security tokens. Additionally, implement defense-in-depth controls such as enforcing HTTPS to protect session cookies in transit, setting secure and HttpOnly flags on cookies, and employing session expiration and re-authentication policies. Monitoring for anomalous session activity and implementing multi-factor authentication can further reduce risk.
Description
Apache::AuthAny::Cookie v0.201 or earlier for Perl generates session ids insecurely. Session ids are generated using an MD5 hash of the epoch time and a call to the built-in rand function. The epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems.