CVE-2026-5084

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-5084
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5084.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-5084
Published
2026-05-11T06:37:19.384Z
Modified
2026-08-03T03:30:23.547965620Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
WebDyne::Session versions before 3.003_704 for Perl generate the session id insecurely
Details

WebDyne::Session versions before 3.003_704 for Perl generate the session id insecurely.

The session handler generates the session id from an MD5 hash seeded with a call to the built-in rand() function. The rand function is passed a maximum value based on the process id, the epoch time and the reference address of the object, but this information will have no effect on the overall quality of the seed of the message digest.

The rand function is seeded by 32-bits and is predictable. It is considered unsuitable for cryptographic purposes.

Predictable session ids could allow an attacker to gain access to systems.

Note that WebDyne::Session versions 1.042 and earlier appear to be in separate distributions from WebDyne.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5084.json",
    "cna_assigner": "CPANSec",
    "cwe_ids": [
        "CWE-338",
        "CWE-340"
    ]
}
References

Affected packages

Git / github.com/aspeer/webdyne

Affected ranges

Type
GIT
Repo
https://github.com/aspeer/webdyne
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
5d096181fd3e474424d4a5f084351c6d461bc2f6
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.003_704"
        }
    ]
}

Affected versions

WebDyne_1.*
WebDyne_1.133
WebDyne_1.134
WebDyne_1.135
WebDyne_1.137
WebDyne_1.138
WebDyne_1.139
WebDyne_1.140
WebDyne_1.141
WebDyne_1.142
WebDyne_1.143
WebDyne_1.144
WebDyne_1.145
WebDyne_1.146
WebDyne_1.147
WebDyne_1.148
WebDyne_1.149
WebDyne_1.150
WebDyne_1.151
WebDyne_1.152
WebDyne_1.153
WebDyne_1.154
WebDyne_1.155
WebDyne_1.156
WebDyne_1.157
WebDyne_1.158
WebDyne_1.159
WebDyne_1.160
WebDyne_1.161
WebDyne_1.162
WebDyne_1.163
WebDyne_1.164
WebDyne_1.182
WebDyne_1.184
WebDyne_1.185
WebDyne_1.186
WebDyne_1.187
WebDyne_1.188
WebDyne_1.189
WebDyne_1.190
WebDyne_1.192
WebDyne_1.193
WebDyne_1.194
WebDyne_1.195
WebDyne_1.196
WebDyne_1.207
WebDyne_1.208
WebDyne_1.209
WebDyne_1.214
WebDyne_1.215
WebDyne_1.216
WebDyne_1.217
WebDyne_1.218
WebDyne_1.219
WebDyne_1.220
WebDyne_1.221
WebDyne_1.222
WebDyne_1.223
WebDyne_1.224
WebDyne_1.225
WebDyne_1.227
WebDyne_1.228
WebDyne_1.229
WebDyne_1.230
WebDyne_1.231
WebDyne_1.232
WebDyne_1.233
WebDyne_1.239
WebDyne_1.240
WebDyne_1.242
WebDyne_1.243
WebDyne_1.244
WebDyne_1.245
WebDyne_1.246
WebDyne_1.247
WebDyne_1.248
WebDyne_1.249
WebDyne_1.250
WebDyne_1.251
WebDyne_2.*
WebDyne_2.002_58801625
WebDyne_2.003_222
WebDyne_2.004_224
WebDyne_2.005_225
WebDyne_2.006_249
WebDyne_2.007_252
WebDyne_2.008_256
WebDyne_2.009_261
WebDyne_2.010_262
WebDyne_2.011_264
WebDyne_2.012_265
WebDyne_2.013_358
WebDyne_2.014
WebDyne_2.015
WebDyne_2.016
WebDyne_2.017
WebDyne_2.018
WebDyne_2.019
WebDyne_2.020
WebDyne_2.021
WebDyne_2.022
WebDyne_2.023
WebDyne_2.024
WebDyne_2.025
WebDyne_2.026
WebDyne_2.027
WebDyne_2.028
WebDyne_2.029
WebDyne_2.030_410
WebDyne_2.031
WebDyne_2.032
WebDyne_2.033
WebDyne_2.034
WebDyne_2.035
WebDyne_2.036
WebDyne_2.037
WebDyne_2.038
WebDyne_2.039
WebDyne_2.040
WebDyne_2.041
WebDyne_2.042
WebDyne_2.043
WebDyne_2.044
WebDyne_2.045
WebDyne_2.046
WebDyne_2.047
WebDyne_2.048
WebDyne_2.049
WebDyne_2.050
WebDyne_2.051
WebDyne_2.052
WebDyne_2.053
WebDyne_2.054
WebDyne_2.055
WebDyne_2.056
WebDyne_2.057
WebDyne_2.058
WebDyne_2.059
WebDyne_2.060
WebDyne_2.061_523
WebDyne_2.062
WebDyne_2.063
WebDyne_2.064
WebDyne_2.065
WebDyne_2.066
WebDyne_2.067
WebDyne_2.068
WebDyne_2.069
WebDyne_2.070
WebDyne_2.071
WebDyne_2.072
WebDyne_2.073
WebDyne_2.074_566
WebDyne_2.075
Other
pre-new-css
v2.*
v2.48.0
v2.49.0
v2.50.0
v2.51.0
v2.52.0
v2.53.0
v2.54.0
v2.55.0
v2.56.0
v2.57.0
v2.58.0
v2.59.0
v2.60.0
v2.61.523
v2.62.0
v2.63.0
v2.64.0
v2.65.0
v2.66.0
v2.67.0
v2.68.0
v2.69.0
v2.70.0
v2.71.0
v2.72.0
v2.73.0
v2.74.566
v2.75.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5084.json"