CVE-2026-13577 affects Dancer2 versions up to 2.1.0. When the required CSPRNG modules Math::Random::ISAAC::XS and Crypt::URandom are not available, the Dancer2::Core::Role::SessionFactory::generate_id function silently falls back to generating session IDs using a SHA-1 hash of low-entropy inputs such as the built-in rand() output, module path, process ID, internal counters, and a shuffled character string. The built-in rand() function is seeded with only 32 bits and is not suitable for cryptographic use, resulting in predictable session identifiers. This weakness in session ID generation can lead to session prediction attacks.

The vulnerability allows attackers to predict session IDs due to the use of weak entropy sources in the fallback session ID generation. This can lead to unauthorized access to user sessions, compromising confidentiality and availability of affected systems. The CVSS 3.1 base score is 8.2 (high), reflecting network attack vector, low attack complexity, no privileges or user interaction required, with limited confidentiality impact but high availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, ensure that the required CSPRNG modules Math::Random::ISAAC::XS and Crypt::URandom are installed and available to Dancer2 to avoid fallback to insecure session ID generation. Avoid running affected versions without these modules.