CVE-2025-40931 - Vulnerability Analysis

Overview

Apache::Session::Generate::MD5 <= 1.94 for Perl contains a broken authentication caused by insecure session id generation using predictable MD5 seeds, letting attackers predict session ids and gain unauthorized access, exploit requires no special conditions.

Severity & Score

Impact

Attackers can predict session IDs, potentially allowing unauthorized access to user sessions and sensitive data.

Mitigation

Update to the latest version with secure session id generation.

References

• http://www.openwall.com/lists/oss-security/2026/03/05/3
• https://metacpan.org/dist/Apache-Session/source/lib/Apache/Session/Generate/MD5.pm#L27
• https://security.metacpan.org/docs/guides/random-data-for-security.html

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner