CVE-2026-5083

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-5083
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5083.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-5083
Published
2026-04-08T05:53:16.963Z
Modified
2026-08-12T03:51:34.936260033Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
Ado::Sessions versions through 0.935 for Perl generates insecure session ids
Details

Ado::Sessions versions through 0.935 for Perl generates insecure session ids.

The session id is generated from a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.

Predicable session ids could allow an attacker to gain access to systems.

Note that Ado is no longer maintained, and has been removed from the CPAN index. It is still available on BackPAN.

Database specific 
{
    "cwe_ids": [
        "CWE-338",
        "CWE-340"
    ],
    "cna_assigner": "CPANSec",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5083.json"
}
References

Affected packages

Git / github.com/kberov/ado

Affected ranges

Type
GIT
Repo
https://github.com/kberov/ado
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
381f8415c2c27044451973bede90a83e6616bc9d
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "cpe": "cpe:2.3:a:berov:ado\\:\\:sessions:*:*:*:*:*:perl:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.935"
        }
    ]
}

Affected versions

v0.*
v0.11
v0.12
v0.13
v0.14
v0.15
v0.16
v0.17
v0.18
v0.19
v0.20
v0.21
v0.22
v0.23
v0.25
v0.26
v0.27
v0.28
v0.29
v0.30
v0.31
v0.32
v0.33
v0.34
v0.35
v0.36
v0.37
v0.38
v0.39
v0.41
v0.42
v0.43
v0.45
v0.46
v0.47
v0.48
v0.49
v0.50
v0.51
v0.52
v0.53
v0.54
v0.55
v0.56
v0.57
v0.58
v0.59
v0.60
v0.61
v0.62
v0.63
v0.65
v0.67
v0.68
v0.70
v0.71
v0.73
v0.74
v0.75
v0.76
v0.77
v0.78
v0.79
v0.81
v0.83
v0.84
v0.86
v0.87
v0.88
v0.89
v0.901
v0.91
v0.932
v0.933
v0.935

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5083.json"