PT-2025-38160 · Unknown · Apache::Authany::Cookie

Published 2025-09-17 · Updated 2025-09-17 · CVE-2025-40933

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache::AuthAny::Cookie versions 0.201 and earlier

Description The software generates session IDs insecurely using an MD5 hash of the epoch time and the rand function. The epoch time may be guessable if not concealed by the HTTP Date header, and the rand function is not suitable for cryptographic purposes. Predictable session IDs could allow an attacker to gain unauthorized access to systems.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-338

CWE-340

Related Identifiers

CVE-2025-40933

Affected Products

Apache::Authany::Cookie

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-40933 · Security Note
• https://t.me/CVEtracker/32762 · Telegram Post
• https://metacpan.org/release/KGOLDOV/Apache2-AuthAny-0.201/source/lib/Apache2/AuthAny/Cookie.pm · Note
• https://twitter.com/CVEnew/status/1968349159075025045 · Twitter Post