CVE-2026-13577 – Dancer2 versions through 2.1.0 for Perl generate insecure session ids when CSPRNG modules are unavailable

CVE ID :CVE-2026-13577

Published : July 20, 2026, 8:16 a.m. | 1 hour, 26 minutes ago

Description :Dancer2 versions through 2.1.0 for Perl generate insecure session ids when CSPRNG modules are unavailable.

Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id when both Math::Random::ISAAC::XS and Crypt::URandom are unavailable.

The fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function).

These are all low-entropy and easily guessed sources.

The built-in rand() function is seeded with 32-bits and considered unsuitable for security applications.

Predictable session ids could allow an attacker to gain access to systems.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…