CVE-2026-13577: CWE-340 Generation of Predictable Numbers or Identifiers in CROMEDOME Dancer2
Dancer2 versions through 2.1.0 for Perl generate insecure session ids when CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id when both Math::Random::ISAAC::XS and Crypt::URandom are unavailable. The fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function). These are all low-entropy and easily guessed sources. The built-in rand() function is seeded with 32-bits and considered unsuitable for security applications. Predictable session ids could allow an attacker to gain access to systems.
AI Analysis
Technical Summary
Dancer2 versions <=2.1.0 generate session IDs using secure CSPRNG modules Math::Random::ISAAC::XS or Crypt::URandom when available. However, if these modules are missing, the generate_id function silently falls back to a weak method that derives session IDs from a SHA-1 hash of low-entropy inputs such as the built-in rand function output, module path, internal counters, process ID, memory address, and a shuffled character string. The built-in rand function is seeded with only 32 bits and is not suitable for cryptographic use, making the session IDs predictable and vulnerable to guessing attacks.
Potential Impact
Predictable session IDs can allow attackers to guess or predict valid session identifiers, potentially leading to unauthorized access to user sessions or systems relying on these session IDs for authentication or state management.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, ensure that the required CSPRNG modules (Math::Random::ISAAC::XS or Crypt::URandom) are installed and available to Dancer2 to avoid fallback to the insecure session ID generation method.
CVE-2026-13577: CWE-340 Generation of Predictable Numbers or Identifiers in CROMEDOME Dancer2
Description
Dancer2 versions through 2.1.0 for Perl generate insecure session ids when CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id when both Math::Random::ISAAC::XS and Crypt::URandom are unavailable. The fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function). These are all low-entropy and easily guessed sources. The built-in rand() function is seeded with 32-bits and considered unsuitable for security applications. Predictable session ids could allow an attacker to gain access to systems.
CVSS v3.1
Score 8.2high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Dancer2 versions <=2.1.0 generate session IDs using secure CSPRNG modules Math::Random::ISAAC::XS or Crypt::URandom when available. However, if these modules are missing, the generate_id function silently falls back to a weak method that derives session IDs from a SHA-1 hash of low-entropy inputs such as the built-in rand function output, module path, internal counters, process ID, memory address, and a shuffled character string. The built-in rand function is seeded with only 32 bits and is not suitable for cryptographic use, making the session IDs predictable and vulnerable to guessing attacks.
Potential Impact
Predictable session IDs can allow attackers to guess or predict valid session identifiers, potentially leading to unauthorized access to user sessions or systems relying on these session IDs for authentication or state management.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, ensure that the required CSPRNG modules (Math::Random::ISAAC::XS or Crypt::URandom) are installed and available to Dancer2 to avoid fallback to the insecure session ID generation method.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CPANSec
- Date Reserved
- 2026-06-28T20:59:07.978Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5dd8612a4a8d5989a80609
Added to database: 07/20/2026, 08:12:17 UTC
Last enriched: 07/20/2026, 08:26:56 UTC
Last updated: 07/21/2026, 00:07:25 UTC
Views: 47
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.