CVE-2026-5085: Solstice::Session for Perl - Insecure Session ID Generation

Overview

Solstice::Session for Perl, in versions through 1440, generates session identifiers using inputs that the record describes as predictable. According to the record, the _generateSessionID method builds an MD5 digest from the epoch time, a stringified hash reference, the built-in rand() function and the process ID. The same method is used by _generateID in Solstice::Subsession, which belongs to the same distribution.

Impact

• Session identifiers may be predictable, and the record states that this could allow an attacker to gain access to systems.
• The epoch time may be guessed if it is not leaked in the HTTP Date header, rand() is seeded by 16 bits, and the process ID comes from a small set of numbers.
• The record assigns a CVSS score of 9.1 with critical severity. The listed vector describes network attack vector, low complexity, no privileges required and no user interaction, with high confidentiality and integrity impact.

Affected products and versions

• Solstice::Session for Perl: versions through 1440, as listed in the record.
• Solstice::Subsession: the record states that it uses the same session identifier generation approach within the same distribution. No separate version range is given.

Exploitation status

The record shows that this CVE is not listed in CISA KEV. No confirmed exploitation appears in the sources consulted. The record includes an EPSS probability of 0.00528 and a percentile of 0.43906, and an SSVC exploitation value of none with automatable set to yes.

Remediation and mitigation

• The record lists no fixed version. This does not mean that no fix exists, so check the upstream project and the linked MetaCPAN source for Session.pm for updates.
• Identify deployments that use the affected distribution, including components that rely on Solstice::Subsession.
• Where a fix is not yet available, consider limiting exposure of session identifiers and reviewing session lifetimes.
• Once a corrected version is installed, consider invalidating existing sessions so that identifiers generated earlier are no longer accepted.
• Following the guidance on random data for security is a sound reference point for correcting the underlying design.

Detection guidance

• Review authentication and session logs for unusual session reuse, or for sessions that appear from unexpected sources.
• Monitor for repeated access attempts that could indicate session guessing.
• Keep these checks at a general level until a vendor or maintainer provides more specific indicators.

Limitations of the available information

• The record does not provide a fixed version or patch reference.
• The vendor name in the affected product entry is unclear, so the record should be verified against the upstream project.
• The record does not describe a proof of concept, and no exploitation data beyond the listed scores is available.
• The CWE name is not provided in the record, although the identifier CWE-338 is listed.

Sources consulted: NVD entry, oss-security mailing list, MetaCPAN Subsession.pm.

Frequently asked questions

What is the core problem in Solstice::Session?

According to the record, session identifiers are built from inputs that can be guessed or are predictable, including the epoch time, a stringified hash reference, rand() and the process ID. Predictable identifiers may allow unauthorized access.

Is this vulnerability known to be exploited?

The record shows that the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Is a fixed version available?

The record does not list a fixed version. This does not prove that no fix exists, so check the upstream project and linked sources for updates.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.