CVE-2009-10007 Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks
Attackers can hijack user sessions by reusing session IDs because the plugin fails to regenerate them after login.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2009-10007?
CVE-2009-10007 is a critical vulnerability in ETHER Catalyst::Plugin::Authentication, published on 9 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks.
Catalyst::Plugin::Authentication does not automatically change the session id after authentication. An attacker that obtains a session id cookie can use this to impersonate the victim.
Weakness: CWE-384
Which versions are affected by CVE-2009-10007?
How do I fix CVE-2009-10007?
Upgrade to a fixed version.
Is CVE-2009-10007 being exploited?
There is no known exploitation of CVE-2009-10007 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2009-10007, GHSA-pfqm-wq4x-p42c, MGASA-2026-0351, UBUNTU-CVE-2009-10007.