Threats affecting pkg:github/Ado

CVE-2026-5083 affects Ado::Sessions versions through 0.935 for Perl by generating insecure, predictable session IDs. The session IDs are created using a SHA-1 hash seeded with the built-in rand function, epoch time, and process ID (PID). Because the PID is from a small set and the epoch time can be guessed or leaked, the session IDs are predictable. This vulnerability could allow attackers to guess session IDs and potentially gain unauthorized access. The Ado::Sessions project is no longer maintained and has been removed from the CPAN index, though it remains available on BackPAN. No official patch or remediation is currently available.