Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a weak random number source for generating the captcha. That version uses the built-in rand() function for generating the captcha text as well as image noise, which is insecure.
The plugin generates CAPTCHA text and image noise using Perl's built-in rand() function. This function is not designed for cryptographic purposes and produces predictable sequences of pseudo-random numbers (CWE-338). As a result, the CAPTCHA verification mechanism (CWE-804) becomes vulnerable to automatic guessing or brute-force attacks, since the space of possible outcomes is practically predictable for an attacker.
An attacker can programmatically predict or effectively guess CAPTCHA values, allowing automatic bypassing of bot protection measures — including mass registrations, brute-force attacks on login forms, or spam.
The module should be updated to version 1.06 or newer, in which the issue has been fixed according to the vendor's changelog (metacpan.org). Version 1.06 replaces rand() with a cryptographically secure source of randomness.
Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N