Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-5084

WebDyne::Session versions before 3.003_704 for Perl generate the session id insecurely. The session handler generates the session id from an MD5 hash seeded with a call to the built-in rand() function. The rand function is passed a maximum value based on the process id, the epoch time and the reference address of the object, but this information will have no effect on the overall quality of the seed of the message digest. The rand function is seeded by 32-bits and is predictable. It is conside
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:53eb6bb1c25db4c675ee8d238acaea933f16f2ddca836e459b64d2c98ff66c28
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

cwe · 2 assertions

{"cweId":"CWE-338","description":"CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:dd55d4c6c5a842e0a058220aa533d25e5144ca41cdbb868516b3663d31fc26ad · sha256:220ae376220e4a8b… · /containers/cna/problemTypes/1/descriptions/0

{"cweId":"CWE-340","description":"CWE-340 Generation of Predictable Numbers or Identifiers","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:dd55d4c6c5a842e0a058220aa533d25e5144ca41cdbb868516b3663d31fc26ad · sha256:220ae376220e4a8b… · /containers/cna/problemTypes/0/descriptions/0

Affected products and versions

1 source assertion
{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","packageName":"WebDyne","product":"WebDyne::Session","programFiles":["lib/WebDyne/Session.pm"],"programRoutines":[{"name":"WebDyne::Session::handler"}],"repo":"https://github.com/aspeer/WebDyne","vendor":"ASPEER","versions":[{"lessThan":"3.003_704","status":"affected","version":"0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:dd55d4c6c5a842e0a058220aa533d25e5144ca41cdbb868516b3663d31fc26ad · sha256:220ae376220e4a8b… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:dd55d4c6c5a842e0a058220aa533d25e5144ca41cdbb868516b3663d31fc26ad · sha256:220ae376220e4a8b… · /containers/adp/0/metrics/0/cvssV3_1

CWE assertions

2 source assertions
{"cweId":"CWE-338","description":"CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:dd55d4c6c5a842e0a058220aa533d25e5144ca41cdbb868516b3663d31fc26ad · sha256:220ae376220e4a8b… · /containers/cna/problemTypes/1/descriptions/0
{"cweId":"CWE-340","description":"CWE-340 Generation of Predictable Numbers or Identifiers","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:dd55d4c6c5a842e0a058220aa533d25e5144ca41cdbb868516b3663d31fc26ad · sha256:220ae376220e4a8b… · /containers/cna/problemTypes/0/descriptions/0

Source references

5 source assertions
{"url":"http://www.openwall.com/lists/oss-security/2026/05/11/3"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:dd55d4c6c5a842e0a058220aa533d25e5144ca41cdbb868516b3663d31fc26ad · sha256:220ae376220e4a8b… · /containers/adp/1/references/0
{"tags":["patch"],"url":"https://github.com/aspeer/WebDyne/commit/7a3f949dc24e62a276eb0db629db64aca356e954.patch"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:dd55d4c6c5a842e0a058220aa533d25e5144ca41cdbb868516b3663d31fc26ad · sha256:220ae376220e4a8b… · /containers/cna/references/1
{"url":"https://metacpan.org/release/ASPEER/WebDyne-2.075/source/lib/WebDyne/Session.pm#L120"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:dd55d4c6c5a842e0a058220aa533d25e5144ca41cdbb868516b3663d31fc26ad · sha256:220ae376220e4a8b… · /containers/cna/references/0
{"tags":["technical-description"],"url":"https://security.metacpan.org/docs/guides/random-data-for-security.html"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:dd55d4c6c5a842e0a058220aa533d25e5144ca41cdbb868516b3663d31fc26ad · sha256:220ae376220e4a8b… · /containers/cna/references/3
{"url":"https://webdyne.org"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:dd55d4c6c5a842e0a058220aa533d25e5144ca41cdbb868516b3663d31fc26ad · sha256:220ae376220e4a8b… · /containers/cna/references/2

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer