The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.
Predicable session ids could allow an attacker to gain access to systems.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| MIYAGAWA | Plack::Middleware::Session | unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Users are advised to upgrade to Plack-Middleware-Session v0.35 or later.
Vendor Workaround
Users who are unable to upgrade are advised to change the sid_generator attribute of Plack::Session::State to a function that returns a securely generated session id based on a secure source of entropy from the system.
Tracking
Sign in to view the affected projects.
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2025-21693 | Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems. |
Tue, 04 Nov 2025 22:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Wed, 16 Jul 2025 21:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Wed, 16 Jul 2025 13:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems. | |
| Title | Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely | |
| Weaknesses | CWE-338 CWE-340 |
|
| References |
|
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2025-11-04T21:10:20.704Z
Reserved: 2025-04-16T09:05:34.362Z
Link: CVE-2025-40923
Vulnrichment
Updated: 2025-11-04T21:10:20.704Z
NVD
Status : Deferred
Published: 2025-07-16T13:15:23.997
Modified: 2026-04-15T00:35:42.020
Link: CVE-2025-40923
Redhat
No data.
OpenCVE Enrichment
No data.