CVE-2026-5087 identifies a vulnerability in PAGI::Middleware::Session::Store::Cookie (versions through 0.001003) where the generation of random bytes for the encryption IV is insecure. The module attempts to read from /dev/urandom; if this fails (e.g., on Windows systems), it emits a warning and uses the built-in rand function to generate random bytes. Since rand is not cryptographically secure, the resulting IV is predictable. This weakness can compromise the confidentiality of session cookies by making it easier for attackers to decrypt or tamper with them. The module does not utilize the Crypt::URandom module, and installing Crypt::URandom does not mitigate the vulnerability. There is no known patch or vendor advisory indicating a fix.

The use of a predictable initialization vector in cookie encryption can lead to the compromise of session confidentiality. Attackers may decrypt or manipulate session data stored in cookies, potentially leading to unauthorized access or session hijacking. The vulnerability affects confidentiality (high impact) but does not affect integrity or availability directly. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is available, users should consider alternative secure session management modules that use cryptographically secure random number generators. Installing Crypt::URandom does not mitigate the issue. Until a fix is released, avoid using this module in security-sensitive contexts.