Cyber Resilience

CVE-2026-5084

Published
11 May 2026
Modified
17 June 2026
CVSS Score v3.1 6.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS Score 0.0030 23th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-5084 is a medium-severity PRNG (CWE-338) vulnerability. Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Web Session Cookie (T1550.004); ranked at the 23th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to IA-5 (Authenticator Management) and SC-23 (Session Authenticity) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A04:2025 Cryptographic Failures

EU & UK References

Vulnerability Data

WebDyne::Session versions through 2.075 for Perl generates the session id insecurely. The session handler generates the session id from an MD5 hash seeded with a call to the built-in rand() function. The rand function is passed a maximum value based…

more

on the process id, the epoch time and the reference address of the object, but this information will have no effect on the overall quality of the seed of the message digest. The rand function is seeded by 32-bits and is predictable. It is considered unsuitable for cryptographic purposes. Predictable session ids could allow an attacker to gain access to systems. Note that WebDyne::Session versions 1.042 and earlier appear to be in separate distributions from WebDyne.

CWE(s)
CWE-338CWE-340

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1550.004 Web Session Cookie Lateral Movement
Adversaries can use stolen session cookies to authenticate to web applications and services.
attack.mitre.org →
Why these techniques?

Predictable session IDs from weak PRNG directly enable forging/predicting web session cookies for unauthorized access via alternate authentication material.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-13577Shared CWE-338, CWE-340
CVE-2025-40926Shared CWE-338, CWE-340
CVE-2025-40932Shared CWE-338, CWE-340
CVE-2026-2439Shared CWE-338, CWE-340
CVE-2026-5085Shared CWE-338, CWE-340
CVE-2025-40931Shared CWE-338, CWE-340
CVE-2025-15604Shared CWE-338, CWE-340
CVE-2026-3256Shared CWE-338, CWE-340
CVE-2026-9733Shared CWE-338, CWE-340
CVE-2026-9692Shared CWE-338, CWE-340

Affected Assets

—
Session
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SC-23 Session Authenticity
  • IA-5 Authenticator Management
  • AC-3 Access Enforcement
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 9 hardening rules · 4 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V7.2.3
  • V11.5.1
  • V11.3.4

Mitigating Controls (NIST 800-53 r5) AI

SC-23 Session Authenticity good match
prevent

Directly requires protection of session authenticity, which is violated by the predictable MD5/rand()-based session IDs in WebDyne::Session.

IA-5 Authenticator Management good match
prevent

Mandates proper management of authenticators (including session tokens) to ensure sufficient randomness and resistance to prediction attacks.

AC-3 Access Enforcement partial match
prevent

Enforces that access decisions are based on valid authentication, blocking the unauthorized access that results from guessed session IDs.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices explicitly require cryptographically strong RNG selection and usage in security contexts.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.24 Use of cryptography mostly match
prevents

Mandates use of approved cryptographic controls, directly requiring cryptographically strong RNGs.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing can detect use of weak random number generators.

A.8.25 Secure development life cycle partial match
prevents

Secure SDLC processes should catch weak PRNG usage during design and code review.

A.8.26 Application security requirements partial match
prevents

Application security requirements can specify cryptographically strong random number generation.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure engineering principles include selection of appropriate cryptographic primitives.

A.8.28 Secure coding partial match
prevents

Secure coding standards prohibit use of weak PRNGs in security contexts.

Hardening callouts derived

Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).

Oracle Linux 8 (1 rule)
  • V-248524 OL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. via CWE-340
RHEL 7 (1 rule)
  • V-204497 The Red Hat Enterprise Linux operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. via CWE-340

References