PT-2026-61538 · Dancer2 · Dancer2
CVE-2026-13577
·
Published
2026-07-20
·
Updated
2026-07-20
CVSS v3.1
8.2
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Dancer2 versions prior to 2.1.0
Description
Insecure session IDs are generated when Cryptographically Secure Pseudo-Random Number Generator (CSPRNG) modules are unavailable. The function
generate id() in Dancer2::Core::Role::SessionFactory silently reverts to a session ID derived from the built-in rand() function when both Math::Random::ISAAC::XS and Crypt::URandom are missing. This fallback mechanism utilizes a SHA-1 hash of low-entropy sources, including the rand() function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process ID, the module instance memory address, and a shuffled string created via List::Util::shuffle(). Because the built-in rand() function is seeded with only 32 bits, it is unsuitable for security purposes, potentially allowing an attacker to predict session IDs and gain unauthorized system access.Recommendations
Update Dancer2 to a version later than 2.1.0.
Ensure that
Math::Random::ISAAC::XS or Crypt::URandom modules are installed on the system to avoid the insecure fallback in generate id().Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Dancer2