---
id: CVE-2026-13577
title: >-
  Dancer2 versions before 2.2.0 for Perl generate insecure session ids when
  required CSPRNG modules are unavailable.


  Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a
  built-in rand-derived session id unless both Ma…
summary: >-
  Dancer2 versions before 2.2.0 for Perl generate insecure session ids when
  required CSPRNG modules are unavailable.


  Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a
  built-in rand-derived session id unless both Ma…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H'
cwe:
  - CWE-338
  - CWE-340
product: Dancer2
affected:
  - Dancer2 < 2.2.0
published: '2026-07-20'
updated: '2026-09-20'
sourceUpdated: '2026-09-20T11:16:56.817'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-13577'
references:
  - url: >-
      https://github.com/PerlDancer/Dancer2/blob/v2.1.0/lib/Dancer2/Core/Role/SessionFactory.pm#L142
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
  - url: 'https://github.com/PerlDancer/Dancer2/issues/1807'
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
  - url: 'https://github.com/PerlDancer/Dancer2/pull/1804'
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
  - url: 'https://metacpan.org/release/CROMEDOME/Dancer2-2.2.0/changes'
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-5080'
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-07-20T13:05:03.182340Z'
epss: 0.0057
epssPercentile: 0.44743
ingestedAt: '2026-09-20T11:20:23.388Z'
---

## Overview

Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable.

Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available.

The fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function).

These are all low-entropy and easily guessed sources.

The built-in rand() function is seeded with 32-bits and considered unsuitable for security applications.

Predictable session ids could allow an attacker to gain access to systems.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.