CVE-2026-5088

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-5088 affects Apache::API::Password, a Perl module within the Apache2-API distribution, in versions through 0.5.2. The vulnerability stems from the _make_salt and _make_salt_bcrypt methods, which attempt to generate cryptographically secure random bytes for password hashing salts by loading the Crypt::URandom or Bytes::Random::Secure modules. If both are unavailable, the methods fall back to Perl's built-in rand function to produce 16 bytes, which is unsuitable for cryptographic purposes due to its predictability (CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator). This results in weak salts for password hashing, with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

An attacker can exploit this vulnerability in environments where the affected module is used for password hashing without the required secure random modules installed. No privileges, user interaction, or special access are needed, and exploitation is feasible over a network if the application exposes hashed passwords (e.g., via database compromise or improper storage). Successful exploitation enables high-impact confidentiality loss, as predictable salts allow efficient offline cracking of password hashes through rainbow tables or targeted brute-force attacks, potentially exposing plaintext credentials.

Advisories recommend upgrading to Apache2-API version 0.5.3 or later, which addresses the fallback issue as noted in its release changes. Security guidance from metacpan.org emphasizes using cryptographically secure random sources like Crypt::URandom or Bytes::Random::Secure for all security-sensitive operations, with documentation available in module POD files and the metacpan security guide on random data. The issue was disclosed via the oss-security mailing list on 2026-04-15.