CVE-2026-56016

A flaw was found in perl-CGI-Session. This vulnerability allows a remote attacker to predict session identifiers due to the use of low-entropy sources in the generate_id method. By predicting a session identifier, an attacker can impersonate a user's session, leading to a bypass of authentication mechanisms and potential unauthorized access to sensitive information or functionality.

This Important flaw in perl-CGI-Session allows a remote attacker to bypass authentication by predicting session identifiers. The CGI::Session::ID::md5 module generates session IDs using low-entropy sources, including process ID, epoch time, and a predictable random number generator. This predictability enables an attacker to impersonate a user's session, potentially leading to unauthorized access in web applications utilizing this module for session management.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.