Vulnerability · Published Jun 18, 2026 · Assigned by CPANSec

CVE-2026-9692Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely

Medium 5.3

In plain English

A medium-severity security flaw in Mojolicious::Sessions::Storable from HAYAJO. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 63.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, the heap address of an anonymous hash, and the PID. These are predictable or low-entropy sources that are unsuitable for security purposes.

Affected products (as reported)

Vendor	Product	Versions
HAYAJO	Mojolicious::Sessions::Storable	0 – through 0.05

Weakness: CWE-340, CWE-338 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://security.metacpan.org/patches/M/Mojolicious-Plugin-SessionStore/0.05/CVE-2026-9692-r1.patch patch
https://metacpan.org/release/HAYAJO/Mojolicious-Plugin-SessionStore-0.05/source/lib/Mojolicious/Sessions/Storable.pm#L11-15
https://www.cve.org/CVERecord?id=CVE-2025-40923 vendor-advisory, related, vdb-entry
https://security.metacpan.org/docs/guides/random-data-for-security.html technical-description