Threats affecting pkg:brew/znapzend

Mojolicious versions 7.28 through 9.45 for Perl generate weak HMAC session cookie secrets by default when using the "mojo generate app" tool. This occurs because the tool uses the insecure rand() function to create the secret, which is used for session authentication and integrity. The weakness may allow attackers to brute force session keys. Version 9.46 fixes this by using high-quality randomness. Users must manually replace any previously generated weak secrets to ensure security.

Mojolicious versions from 0.999922 for Perl use a hard coded string or the application's class name as the HMAC session cookie secret by default. This predictable secret allows attackers to forge session cookies, potentially enabling session tampering or hijacking. The vulnerability affects the znapzend product from version 0.23.6 onward. It has a high severity rating with a CVSS score of 8.1.