CVE-2026-5085

The _generateSessionID method creates a session identifier as an MD5 hash built from four predictable components: epoch time (which can be read from the HTTP Date header or guessed), the address of a hash reference cast to a string (containing predictable content), the result of the built-in rand() function initialized with only a 16-bit seed (inadequate for security purposes), and a process identifier (PID) from a limited range of numbers. The same generation method is used in the Solstice::Subsession class in the _generateID method. The combination of these weak randomness elements makes the space of possible session identifiers small enough to be effectively searched by an attacker.

An attacker can predict or guess active session identifiers of other users, enabling session hijacking and obtaining unauthorized access to protected system resources.

Apply patches available from the vendor according to the references. As a supplementary measure, it is recommended to replace the built-in rand() function with a cryptographically secure random number generator (CSPRNG) in accordance with guidelines available at https://security.metacpan.org/docs/guides/random-data-for-security.html.

Solstice::Session (Perl library, Mcrawfor Solstice distribution) in all versions up to and including 1440; the vulnerability also affects the Solstice::Subsession class included in the same distribution.