CVE-2026-2439 Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids
Attackers can guess insecure session IDs generated by the Concierge::Sessions Perl library, leading to unauthorized access and account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-2439?
CVE-2026-2439 is a critical vulnerability in BVA Concierge::Sessions, published on 16 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids. The generate_session_id function in Concierge::Sessions::Base defaults to using the uuidgen command to generate a UUID, with a fallback to using Perl's built-in rand function. Neither of these methods are secure, and attackers are able to guess session_ids that can grant them access to systems. Specifically,
* There is no warning when uuidgen fails. The software can be quietly using the fallback rand() function with no warnings if the command fails for any reason. * The uuidgen command will generate a time-based UUID if the system does not have a high-quality random number source, because the call does not explicitly specify the --random option. Note that the system time is shared in HTTP responses. * UUIDs are identifiers whose mere possession grants access, as per RFC 9562. * The output of the built-in rand() function is predictable and unsuitable for security applications.
Which versions are affected by CVE-2026-2439?
It affects 1 product.
Products include Bva Concierge\.
How do I fix CVE-2026-2439?
No fix has been published for CVE-2026-2439 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-2439 being exploited?
There is no known exploitation of CVE-2026-2439 in the wild and no public exploit code.
Sources
Also known as GHSA-9gww-cr64-679c.