CVE-2025-40923 Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely
Insecure session ID generation in Plack-Middleware-Session allows attackers to predict IDs and hijack user sessions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40923?
CVE-2025-40923 is a high-severity vulnerability in MIYAGAWA Plack::Middleware::Session, published on 16 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely.
The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.
Predicable session ids could allow an attacker to gain access to systems.
Which versions are affected by CVE-2025-40923?
How do I fix CVE-2025-40923?
Upgrade to a fixed version.
Is CVE-2025-40923 being exploited?
There is no known exploitation of CVE-2025-40923 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2025-40923, GHSA-868p-jhqw-wrgr, UBUNTU-CVE-2025-40923.