PT-2026-8387 · Unknown · Concierge::Sessions

Robert Rothenberg · Published 2026-02-16 · Updated 2026-02-17 · CVE-2026-2439

Positive Technologies · (AI Summary)

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Concierge::Sessions versions 0.8.1 through 0.8.4

Description The generate session id function within Concierge::Sessions::Base defaults to insecure methods for generating session identifiers. Specifically, it uses the uuidgen command, which may fall back to Perl's rand() function if uuidgen fails, or generate time-based UUIDs if a high-quality random number source is unavailable. Both rand() and time-based UUIDs are predictable and unsuitable for security applications. The possession of these identifiers grants access, as per RFC 9562. There is no warning when uuidgen fails, potentially leading to the silent use of the insecure rand() function.

Recommendations Upgrade to version 0.8.5 or later.

Fix

Weakness Enumeration

CWE-338

CWE-340

Related Identifiers

CVE-2026-2439

Affected Products

Concierge::Sessions

References · 12

• https://github.com/bwva/Concierge-Sessions/commit/20bb28e92e8fba307c4ff8264701c215be65e73b · Patch
• https://osv.dev/vulnerability/CVE-2026-2439 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2439 · Security Note
• https://t.me/CVEtracker/44855 · Telegram Post
• https://security.metacpan.org/docs/guides/random-data-for-security.html · Note
• https://metacpan.org/release/BVA/Concierge-Sessions-v0.8.4/diff/BVA/Concierge-Sessions-v0.8.5#lib/Concierge/Sessions/Base.pm · Note
• https://twitter.com/offseq/status/2023525348214747391 · Twitter Post
• https://twitter.com/offseq/status/2023812235424887049 · Twitter Post
• https://twitter.com/CVEnew/status/2023532141926379838 · Twitter Post
• https://perldoc.perl.org/5.42.0/functions/rand · Note
• https://t.me/cveNotify/152135 · Telegram Post
• https://rfc-editor.org/rfc/rfc9562.html#name-security-considerations · Note