CVE-2025-40931 - Vulnerability Analysis

Overview

Apache::Session::Generate::MD5 <= 1.94 for Perl contains a broken authentication caused by insecure session id generation using predictable MD5 seeds, letting attackers predict session ids and gain unauthorized access, exploit requires no special conditions.

Severity & Score

Impact

Attackers can predict session IDs, potentially allowing unauthorized access to user sessions and sensitive data.

Mitigation

Update to the latest version with secure session id generation.

References

• http://www.openwall.com/lists/oss-security/2026/03/05/3
• https://metacpan.org/dist/Apache-Session/source/lib/Apache/Session/Generate/MD5.pm#L27
• https://security.metacpan.org/docs/guides/random-data-for-security.html

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 5, 2026

🔴 CVE-2025-40931 - Critical (9.1) Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id. Apache::Session::Generate::MD5 generates session ids insecurely. The default session id generator returns a MD5 hash seeded with the built-in rand() functio... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-40931/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner