CVE-2026-9692

Name of the Vulnerable Software and Affected Versions Mojolicious::Sessions::Storable versions prior to 0.06

Description The software generates session IDs insecurely. The default session ID generator utilizes a SHA-1 hash seeded with the built-in rand function, the epoch time, the heap address of an anonymous hash, and the PID. These sources are considered predictable or low-entropy, making them unsuitable for security purposes.

Recommendations Update to version 0.06 or later.