CVE-2026-13577

Name of the Vulnerable Software and Affected Versions Dancer2 versions prior to 2.1.0

Description Insecure session IDs are generated when Cryptographically Secure Pseudo-Random Number Generator (CSPRNG) modules are unavailable. The function generate id() in Dancer2::Core::Role::SessionFactory silently reverts to a session ID derived from the built-in rand() function when both Math::Random::ISAAC::XS and Crypt::URandom are missing. This fallback mechanism utilizes a SHA-1 hash of low-entropy sources, including the rand() function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process ID, the module instance memory address, and a shuffled string created via List::Util::shuffle(). Because the built-in rand() function is seeded with only 32 bits, it is unsuitable for security purposes, potentially allowing an attacker to predict session IDs and gain unauthorized system access.

Recommendations Update Dancer2 to a version later than 2.1.0. Ensure that Math::Random::ISAAC::XS or Crypt::URandom modules are installed on the system to avoid the insecure fallback in generate id().