CVE-2025-40915 Mojolicious::Plugin::CSRF 1.03 for Perl uses a weak random number source for generating CSRF tokens
Weak random number generation in Mojolicious::Plugin::CSRF allows attackers to predict tokens and bypass CSRF protections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-40915?
CVE-2025-40915 is a high-severity vulnerability in GRYPHON Mojolicious::Plugin::CSRF, published on 11 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Mojolicious::Plugin::CSRF 1.03 for Perl uses a weak random number source for generating CSRF tokens.
That version of the module generates tokens as an MD5 of the process id, the current time, and a single call to the built-in rand() function.
Weakness: CWE-338
Which versions are affected by CVE-2025-40915?
How do I fix CVE-2025-40915?
No fix has been published for CVE-2025-40915 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-40915 being exploited?
There is no known exploitation of CVE-2025-40915 in the wild and no public exploit code.
Sources
Also known as GHSA-mqr9-mgqq-52rq.