Trog::TOTP versions prior to 1.006 use Perl's built-in rand function to generate secrets for time-based one-time passwords (TOTP). Since rand is predictable and not cryptographically secure, the generated secrets lack sufficient entropy (CWE-331), making them vulnerable to prediction attacks. This undermines the security guarantees of the TOTP mechanism, potentially allowing attackers to guess or reproduce valid one-time passwords. The CVSS v3.1 base score is 7.5, reflecting a network attack vector with low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

The vulnerability impacts the confidentiality of TOTP secrets generated by the affected versions of Trog::TOTP. An attacker could potentially predict or reproduce these secrets due to insufficient entropy, compromising the security of authentication mechanisms relying on these one-time passwords. There is no indication of impact on integrity or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid using affected versions of Trog::TOTP for security-critical applications or implement additional entropy sources for secret generation. Monitoring vendor channels for updates is recommended.