CVE-2026-5082: CWE-340 Generation of Predictable Numbers or Identifiers in TOKUHIROM Amon2::Plugin::Web::CSRFDefender
CVE-2026-5082 affects Amon2::Plugin::Web::CSRFDefender versions 7. 00 through 7. 03 for Perl, where the session ID generation is insecure. The vulnerability arises because the generate_session_id function falls back to a weak method using SHA-1 seeded with the built-in rand() function, process ID, and epoch time if /dev/urandom is unavailable. This fallback is predictable due to the limited entropy of the PID and the guessable epoch time, combined with the unsuitable cryptographic quality of the built-in rand function. The module has been deprecated by its author. No official patch or remediation guidance is currently available.
AI Analysis
Technical Summary
Amon2::Plugin::Web::CSRFDefender versions 7.00 to 7.03 generate session IDs insecurely when /dev/urandom is not accessible. The fallback method uses SHA-1 hashing seeded with the built-in rand(), process ID, and high resolution epoch time, all of which provide insufficient entropy and predictability. This leads to predictable session identifiers, weakening the security of CSRF defenses. Earlier versions before 7.00 were also vulnerable due to a related issue (CVE-2025-15604). The module is deprecated, and no official fix or patch has been published.
Potential Impact
The insecure session ID generation can allow attackers to predict session identifiers, potentially undermining the effectiveness of CSRF protection mechanisms relying on these tokens. This could lead to increased risk of CSRF attacks if an attacker can guess or reproduce valid session IDs. However, no known exploits are reported in the wild. The module's deprecation suggests no further maintenance or fixes will be provided.
Mitigation Recommendations
No official patch or remediation is currently available for this vulnerability. Since the module is deprecated, users are advised to discontinue use of Amon2::Plugin::Web::CSRFDefender and migrate to alternative, actively maintained CSRF protection solutions that use cryptographically secure random number generation. Patch status is not yet confirmed — check the vendor advisory or project repository for any updates or recommended replacements.
CVE-2026-5082: CWE-340 Generation of Predictable Numbers or Identifiers in TOKUHIROM Amon2::Plugin::Web::CSRFDefender
Description
CVE-2026-5082 affects Amon2::Plugin::Web::CSRFDefender versions 7. 00 through 7. 03 for Perl, where the session ID generation is insecure. The vulnerability arises because the generate_session_id function falls back to a weak method using SHA-1 seeded with the built-in rand() function, process ID, and epoch time if /dev/urandom is unavailable. This fallback is predictable due to the limited entropy of the PID and the guessable epoch time, combined with the unsuitable cryptographic quality of the built-in rand function. The module has been deprecated by its author. No official patch or remediation guidance is currently available.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Amon2::Plugin::Web::CSRFDefender versions 7.00 to 7.03 generate session IDs insecurely when /dev/urandom is not accessible. The fallback method uses SHA-1 hashing seeded with the built-in rand(), process ID, and high resolution epoch time, all of which provide insufficient entropy and predictability. This leads to predictable session identifiers, weakening the security of CSRF defenses. Earlier versions before 7.00 were also vulnerable due to a related issue (CVE-2025-15604). The module is deprecated, and no official fix or patch has been published.
Potential Impact
The insecure session ID generation can allow attackers to predict session identifiers, potentially undermining the effectiveness of CSRF protection mechanisms relying on these tokens. This could lead to increased risk of CSRF attacks if an attacker can guess or reproduce valid session IDs. However, no known exploits are reported in the wild. The module's deprecation suggests no further maintenance or fixes will be provided.
Mitigation Recommendations
No official patch or remediation is currently available for this vulnerability. Since the module is deprecated, users are advised to discontinue use of Amon2::Plugin::Web::CSRFDefender and migrate to alternative, actively maintained CSRF protection solutions that use cryptographically secure random number generation. Patch status is not yet confirmed — check the vendor advisory or project repository for any updates or recommended replacements.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CPANSec
- Date Reserved
- 2026-03-28T19:12:35.387Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d5f0511cc7ad14da136bda
Added to database: 4/8/2026, 6:06:09 AM
Last enriched: 4/8/2026, 6:20:55 AM
Last updated: 4/8/2026, 8:12:37 AM
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.