{"id":"CVE-2026-13577","title":"Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable.\n\nDancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id unless both Ma…","summary":"Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable.\n\nDancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id unless both Ma…","severity":"high","cvss":8.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","cwe":["CWE-338","CWE-340"],"product":"Dancer2","affected":["Dancer2 < 2.2.0"],"published":"2026-07-20","updated":"2026-09-20","sourceUpdated":"2026-09-20T11:16:56.817","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-13577","references":[{"url":"https://github.com/PerlDancer/Dancer2/blob/v2.1.0/lib/Dancer2/Core/Role/SessionFactory.pm#L142","label":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://github.com/PerlDancer/Dancer2/issues/1807","label":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://github.com/PerlDancer/Dancer2/pull/1804","label":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://metacpan.org/release/CROMEDOME/Dancer2-2.2.0/changes","label":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5080","label":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-07-20T13:05:03.182340Z"},"epss":0.0057,"epssPercentile":0.45659,"ingestedAt":"2026-09-20T11:20:23.388Z","slug":"CVE-2026-13577","body":"## Overview\n\nDancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable.\n\nDancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available.\n\nThe fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function).\n\nThese are all low-entropy and easily guessed sources.\n\nThe built-in rand() function is seeded with 32-bits and considered unsuitable for security applications.\n\nPredictable session ids could allow an attacker to gain access to systems.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":45.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}