PT-2026-33009 · Unknown · Apache::Api::Password

Published 2026-04-15 · Updated 2026-05-06 · CVE-2026-5088

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache::API::Password versions prior to 0.5.3

Description The software can generate insecure random values for salts used in password hashing. The functions make salt() and make salt bcrypt() attempt to load Crypt::URandom and Bytes::Random::Secure to generate random bytes. If these modules are unavailable, the system falls back to using Perl's built-in rand function, which is unsuitable for cryptographic purposes.

Recommendations Update to a version later than 0.5.2.

Fix

Weakness Enumeration

CWE-338

Related Identifiers

CVE-2026-5088

Affected Products

Apache::Api::Password

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-5088 · Security Note
• https://metacpan.org/release/JDEGUEST/Apache2-API-v0.5.2/view/lib/Apache2/API/Password.pod · Note
• https://t.me/cveNotify/162349 · Telegram Post
• https://security.metacpan.org/docs/guides/random-data-for-security.html · Note
• http://openwall.com/lists/oss-security/2026/04/15/4 · Note
• https://metacpan.org/release/JDEGUEST/Apache2-API-v0.5.3/changes · Note
• https://metacpan.org/pod/Crypt::URandom · Note
• https://twitter.com/CVEnew/status/2044338840056570317 · Twitter Post
• https://twitter.com/oss_security/status/2044455436565287385 · Twitter Post
• http://openwall.com/lists/oss-security/2026/04/15/5 · Note