CVE-2026-19565

Name of the Vulnerable Software and Affected Versions Apache::AppSamurai::Util versions through 1.01

Description Predictable session authentication keys are generated in the CreateSessionAuthKey() function. The process involves five rounds of SHA-256 hashing using the process id and readings from Time::HiRes formatted to six decimal places. Because the microsecond field has limited values and the process id is drawn from a small range, the resulting 64-character hex key is predictable. This key is used as a session cookie and combined with a server key to compute session IDs and encrypt session data. An attacker knowing the session creation second and the worker process id can enumerate candidate keys to recover a victim's cookie and bypass authentication for protected resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.