PT-2026-31088 · Unknown · Ado::Sessions

Published 2026-04-08 · Updated 2026-04-13 · CVE-2026-5083

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Ado::Sessions versions through 0.935

Description The Ado::Sessions Perl module generates insecure session IDs. The session ID is created using a SHA-1 hash seeded with the built-in rand function, the epoch time, and the process ID (PID). The PID comes from a limited range of numbers, and the epoch time may be predictable. The rand function is not suitable for cryptographic purposes. Predictable session IDs could allow an attacker to gain unauthorized access to systems.

Recommendations Update to a newer version that contains a fix for this vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-340

CWE-338

Related Identifiers

CVE-2026-5083

Affected Products

Ado::Sessions

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-5083 · Security Note
• https://github.com/kberov/Ado/issues/112 · Note
• http://openwall.com/lists/oss-security/2026/04/08/7 · Note
• https://twitter.com/oss_security/status/2042097712837832774 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2041770608547991979 · Twitter Post
• https://security.metacpan.org/docs/guides/random-data-for-security.html · Note
• https://twitter.com/CVEnew/status/2043561073312153613 · Twitter Post
• https://backpan.perl.org/authors/id/B/BE/BEROV/Ado-0.935.tar.gz · Note
• https://t.me/cveNotify/158419 · Telegram Post