CVE-2024-58134 Hardcoded credentials in Mojolicious
Attackers can forge session cookies using predictable default HMAC secrets to hijack user sessions in Mojolicious applications.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-58134?
CVE-2024-58134 is a high-severity vulnerability in SRI Mojolicious, published on 3 May 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default.
These predictable default secrets can be exploited by an attacker to forge session cookies. An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user’s session.
Which versions are affected by CVE-2024-58134?
It affects 1 product.
Products include Mojolicious Mojolicious.
How do I fix CVE-2024-58134?
No fix has been published for CVE-2024-58134 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-58134 being exploited?
There is no known exploitation of CVE-2024-58134 in the wild and no public exploit code.
Other vulnerabilities in SRI Mojolicious
Sources
Also known as AZL-61673, AZL-61825, DEBIAN-CVE-2024-58134, GHSA-3g23-7g3r-898j, UBUNTU-CVE-2024-58134.