Threats affecting pkg:github/Amon2-Plugin-Web-CSRFDefender

CVE-2026-5082 affects Amon2::Plugin::Web::CSRFDefender versions 7.00 through 7.03 for Perl, where the module generates insecure session IDs. The vulnerability arises because if /dev/urandom is unavailable, the session ID generation falls back to a SHA-1 hash seeded with the built-in rand() function, process ID, and epoch time, which are predictable or guessable values. This weak randomness can lead to predictable session identifiers. The module has been deprecated by its author. No official patch or remediation is currently documented.