CVE-2025-40926: Perl Insecure Session Id From Rand Hashcve-2025-40926-perl-insecure-session-id-from-rand-hash
Session/token identifier is derived by hashing the output of Perl's built-in rand(), which is a non-cryptographic PRNG seeded with only ~32 bits and is therefore predictable. Combining it with $$ (PID), time, or stringified references (memory addresses) does not add meaningful entropy, and wrapping the result in a digest (sha1_hex/md5_hex/sha256_hex/...) doe