PT-2026-23117 · Unknown · Plack::Middleware::Session::Simple

Published 2026-03-05 · Updated 2026-03-12 · CVE-2025-40926

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Plack::Middleware::Session::Simple versions through 0.04

Description The software generates session IDs insecurely. The default session ID generator uses a SHA-1 hash seeded with the built-in rand function, the epoch time, and the process ID (PID). The PID comes from a limited set of numbers, and the epoch time may be predictable. The rand function is not suitable for cryptographic purposes. Predictable session IDs could allow an attacker to gain access to systems. This issue is similar to a security issue in Plack::Middleware::Session.

Recommendations Update Plack::Middleware::Session::Simple to a version later than 0.04.

Fix

Weakness Enumeration

CWE-340

CWE-338

Related Identifiers

CVE-2025-40926

Affected Products

Plack::Middleware::Session::Simple

References · 12

• https://github.com/kazeburo/Plack-Middleware-Session-Simple/commit/760bb358b8f53e52cf415888a4ac858fd99bb24e.patch · Patch
• https://github.com/kazeburo/Plack-Middleware-Session-Simple/pull/4 · Patch
• https://osv.dev/vulnerability/CVE-2025-40926 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-40923 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-40926 · Security Note
• https://t.me/CVEtracker/46394 · Telegram Post
• https://metacpan.org/release/KAZEBURO/Plack-Middleware-Session-Simple-0.04/source/lib/Plack/Middleware/Session/Simple.pm#L43 · Note
• https://t.me/cveNotify/155201 · Telegram Post
• https://metacpan.org/release/KAZEBURO/Plack-Middleware-Session-Simple-0.05/changes · Note
• https://twitter.com/oss_security/status/2030832181975691511 · Twitter Post
• https://twitter.com/CVEnew/status/2030755425511932130 · Twitter Post
• https://security.metacpan.org/docs/guides/random-data-for-security.html · Note