Crypt::ScryptKDF versions through 0.010 for Perl use an insecure random number source if no CSPRNG modules such as Crypt::PRNG, Crypt::OpenSSL::Random, Net::SSLeay, Crypt::Random, or Bytes::Random::Secure are installed. In this case, the random_bytes function falls back to the built-in rand() function, which is a cryptographically weak pseudo-random number generator. This behavior is classified under CWE-338. The CVSS v3.1 base score is 4.8 (medium severity) with network attack vector, high attack complexity, no privileges or user interaction required, and limited confidentiality and integrity impact.

The use of a cryptographically weak pseudo-random number generator can weaken the security of cryptographic operations that depend on randomness from Crypt::ScryptKDF. This may lead to reduced confidentiality and integrity guarantees in applications using this module without a proper CSPRNG installed. There are no known exploits in the wild reported at this time.

Patch status is not yet confirmed — no official fix or remediation level has been published by the vendor. Users should ensure that at least one supported CSPRNG Perl module (e.g., Crypt::PRNG, Crypt::OpenSSL::Random, Net::SSLeay, Crypt::Random, or Bytes::Random::Secure) is installed and available in their environment to avoid fallback to the insecure rand() function. Monitor the vendor advisory for updates regarding an official fix.