CVE-2026-5085 - Vulnerability Analysis

Overview

Solstice::Session through version 1440 contains a broken authentication caused by insecure session ID generation using predictable epoch time, weak rand() seeding, and process ID, letting attackers guess session IDs to gain unauthorized access, exploit requires no special privileges.

Severity & Score

Impact

Attackers can predict session IDs to gain unauthorized access to user sessions, potentially compromising system security.

Mitigation

Update to the latest version with secure session ID generation.

References

• https://metacpan.org/dist/Solstice/source/lib/Solstice/Subsession.pm#L105
• https://security.metacpan.org/docs/guides/random-data-for-security.html
• http://www.openwall.com/lists/oss-security/2026/04/13/2
• https://metacpan.org/dist/Solstice/source/lib/Solstice/Session.pm#L481

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner