CVE-2026-46473 identifies a vulnerability in Authen::TOTP versions prior to 0.1.1 where the Perl module generates TOTP secrets using the built-in rand function. Since rand is predictable and not suitable for cryptographic purposes, the generated secrets lack sufficient entropy, weakening the security of time-based one-time passwords. This vulnerability is classified under CWE-331 (Insufficient Entropy). The CVSS 3.1 base score is 7.5, reflecting a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to confidentiality. No vendor advisory or patch is currently available, and the vulnerability is not known to be exploited in the wild.

The insufficient entropy in secret generation compromises the confidentiality of TOTP secrets, potentially allowing attackers to predict or reproduce one-time passwords. This undermines the security of authentication mechanisms relying on Authen::TOTP prior to version 0.1.1. There is no indication of integrity or availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently available, users should avoid using vulnerable versions of Authen::TOTP and consider alternative TOTP implementations that use cryptographically secure random number generators. Monitor vendor channels for updates or official fixes.