CVE-2026-5084

Name of the Vulnerable Software and Affected Versions WebDyne::Session versions prior to 3.003 704

Description The session handler generates session identifiers insecurely using an MD5 hash seeded with the built-in rand() function. The rand() function is seeded by 32-bits, making it predictable and unsuitable for cryptographic purposes. Although the function is passed a maximum value based on the process ID, epoch time, and the reference address of the object, these factors do not improve the quality of the message digest seed. This predictability could allow an attacker to gain unauthorized access to systems.

Recommendations Update WebDyne::Session to version 3.003 704 or later.