BVA Concierge::Sessions up to 0.8.4 on Perl rand generation of predictable numbers or identifiers

Summaryinfo

A vulnerability was found in BVA Concierge::Sessions up to 0.8.4 on Perl. It has been classified as problematic. Affected by this vulnerability is the function rand. This manipulation causes generation of predictable numbers or identifiers. This vulnerability is registered as CVE-2026-2439. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in BVA Concierge::Sessions up to 0.8.4 on Perl and classified as problematic. Affected by this vulnerability is the function rand. The manipulation with an unknown input leads to a generation of predictable numbers or identifiers vulnerability. The CWE definition for the vulnerability is CWE-340. The product uses a scheme that generates numbers or identifiers that are more predictable than required. As an impact it is known to affect confidentiality. The summary by CVE is:

Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids. The generate_session_id function in Concierge::Sessions::Base defaults to using the uuidgen command to generate a UUID, with a fallback to using Perl's built-in rand function. Neither of these methods are secure, and attackers are able to guess session_ids that can grant them access to systems. Specifically, * There is no warning when uuidgen fails. The software can be quietly using the fallback rand() function with no warnings if the command fails for any reason. * The uuidgen command will generate a time-based UUID if the system does not have a high-quality random number source, because the call does not explicitly specify the --random option. Note that the system time is shared in HTTP responses. * UUIDs are identifiers whose mere possession grants access, as per RFC 9562. * The output of the built-in rand() function is predictable and unsuitable for security applications.

The weakness was published by Robert Rothenberg. The advisory is shared at metacpan.org. This vulnerability is known as CVE-2026-2439 since 02/13/2026. The exploitation appears to be difficult. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1600.001 for this issue.

Upgrading to version 0.8.5 eliminates this vulnerability. Applying the patch 20bb28e92e8fba307c4ff8264701c215be65e73b is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• BVA

Name

• Concierge::Sessions

Version

• 0.8.0
• 0.8.1
• 0.8.2
• 0.8.3
• 0.8.4

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion