PT-2026-29290 · Jjnapiork+1 · Pagi::Middleware::Session::Store::Cookie+1

Robert Rothenberg · CVE-2026-5087 · Published 2026-03-31 · Updated 2026-07-24

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions PAGI::Middleware::Session::Store::Cookie versions prior to 0.001003

Description The software generates random bytes insecurely when it cannot read from the /dev/urandom device, which occurs on systems like Windows. In such cases, it uses the built-in rand function to generate an initialisation vector (IV)—a random block of data used to start the encryption process—which is unsuitable for cryptographic purposes. A predictable IV may allow malicious users to decrypt and tamper with session data stored in the cookie.

Recommendations Update PAGI::Middleware::Session::Store::Cookie to a version newer than 0.001003.

Exploit

Fix

Weakness Enumeration

CWE-1204

CWE-338

Related Identifiers

CVE-2026-5087

Affected Products

Pagi::Middleware::Session::Store::Cookie

Pagi

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5087.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-5087 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5087 · Security Note
• https://github.com/jjn1056/PAGI-Middleware-Session-Store-Cookie · Note
• https://t.me/cveNotify/221370 · Telegram Post
• https://twitter.com/oss_security/status/2039551115159535927 · Twitter Post
• https://metacpan.org/release/JJNAPIORK/PAGI-Middleware-Session-Store-Cookie-0.001004/changes · Note
• https://metacpan.org/release/JJNAPIORK/PAGI-Middleware-Session-Store-Cookie-0.001003/source/lib/PAGI/Middleware/Session/Store/Cookie.pm#L156-173 · Note
• http://openwall.com/lists/oss-security/2026/03/31/10 · Note
• https://cpan.org/modules · Note