Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default. When creating a default app skeleton with the "mojo generate app" tool, a weak secret is written to the application's configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application's sessions. This may allow an attacker to brute force the application's session keys. Release 9.46 fixes the issue by providing high quality randomness, even in absence of CryptX. Users should be aware that the update does not replace previously generated weak secrets. A secret generated with the previous version MUST be replaced to ensure the updated version is using a strong secret.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00632.

Exploitation poc

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Mojolicious
  • Mojolicious

Configuration 1 [-]

cpe:2.3:a:mojolicious:mojolicious:*:*:*:*:*:perl:*:*

No data.

No data.

References
Link Providers
https://github.com/hashcat/hashcat/pull/4090 cve-icon cve-icon
https://github.com/mojolicious/mojo/commit/789cfa43f9118852b38cbd1fd0a2596bcb9821ea.patch cve-icon cve-icon
https://github.com/mojolicious/mojo/commit/fb3733f92cc8a3344e6d615b3c7dac9d538eeab0.patch cve-icon cve-icon
https://github.com/mojolicious/mojo/pull/2200 cve-icon cve-icon
https://lists.debian.org/debian-perl/2025/05/msg00016.html cve-icon cve-icon
https://lists.debian.org/debian-perl/2025/05/msg00017.html cve-icon cve-icon
https://lists.debian.org/debian-perl/2025/05/msg00018.html cve-icon cve-icon
https://metacpan.org/release/SRI/Mojolicious-7.28/source/lib/Mojolicious/Command/generate/app.pm#L220 cve-icon cve-icon
https://metacpan.org/release/SRI/Mojolicious-9.38/source/lib/Mojolicious/Command/Author/generate/app.pm#L202 cve-icon cve-icon
https://metacpan.org/release/SRI/Mojolicious-9.39/source/lib/Mojo/Util.pm#L181 cve-icon cve-icon
https://metacpan.org/release/SRI/Mojolicious-9.46/source/Changes cve-icon cve-icon
https://perldoc.perl.org/functions/rand cve-icon cve-icon
https://security.metacpan.org/docs/guides/random-data-for-security.html cve-icon cve-icon
History

Fri, 05 Jun 2026 13:45:00 +0000

Type Values Removed Values Added
Description Mojolicious versions from 7.28 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default When creating a default app skeleton with the "mojo generate app" tool, a weak secret is written to the application's configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application's sessions. This may allow an attacker to brute force the application's session keys. Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default. When creating a default app skeleton with the "mojo generate app" tool, a weak secret is written to the application's configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application's sessions. This may allow an attacker to brute force the application's session keys. Release 9.46 fixes the issue by providing high quality randomness, even in absence of CryptX. Users should be aware that the update does not replace previously generated weak secrets. A secret generated with the previous version MUST be replaced to ensure the updated version is using a strong secret.
Title Mojolicious versions from 7.28 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default
References

Mon, 20 Oct 2025 20:15:00 +0000

Type Values Removed Values Added
Description Mojolicious versions from 7.28 through 9.40 for Perl may generate weak HMAC session secrets. When creating a default app with the "mojo generate app" tool, a weak secret is written to the application's configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application's sessions. This may allow an attacker to brute force the application's session keys. Mojolicious versions from 7.28 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default When creating a default app skeleton with the "mojo generate app" tool, a weak secret is written to the application's configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application's sessions. This may allow an attacker to brute force the application's session keys.
Title Mojolicious versions from 7.28 through 9.40 for Perl may generate weak HMAC session secrets Mojolicious versions from 7.28 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default
References

Tue, 17 Jun 2025 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Mojolicious
Mojolicious mojolicious
CPEs cpe:2.3:a:mojolicious:mojolicious:*:*:*:*:*:perl:*:*
Vendors & Products Mojolicious
Mojolicious mojolicious

Mon, 12 May 2025 18:30:00 +0000

Type Values Removed Values Added
Description Mojolicious versions from 7.28 through 9.39 for Perl may generate weak HMAC session secrets. When creating a default app with the "mojo generate app" tool, a weak secret is written to the application's configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application's sessions. This may allow an attacker to brute force the application's session keys. Mojolicious versions from 7.28 through 9.40 for Perl may generate weak HMAC session secrets. When creating a default app with the "mojo generate app" tool, a weak secret is written to the application's configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application's sessions. This may allow an attacker to brute force the application's session keys.
Title Mojolicious versions from 7.28 through 9.39 for Perl may generate weak HMAC session secrets Mojolicious versions from 7.28 through 9.40 for Perl may generate weak HMAC session secrets

Thu, 08 May 2025 08:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 07 May 2025 19:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Sat, 03 May 2025 10:30:00 +0000

Type Values Removed Values Added
Description Mojolicious versions from 7.28 through 9.39 for Perl may generate weak HMAC session secrets. When creating a default app with the "mojo generate app" tool, a weak secret is written to the application's configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application's sessions. This may allow an attacker to brute force the application's session keys.
Title Mojolicious versions from 7.28 through 9.39 for Perl may generate weak HMAC session secrets
Weaknesses CWE-338
References
cve-icon MITRE

Status: PUBLISHED

Assigner: CPANSec

Published:

Updated: 2026-06-05T12:37:53.344Z

Reserved: 2025-04-07T16:06:37.226Z

Link: CVE-2024-58135

cve-icon Vulnrichment

Updated: 2025-05-05T18:16:35.505Z

cve-icon NVD

Status : Modified

Published: 2025-05-03T11:15:48.037

Modified: 2026-06-05T14:16:31.663

Link: CVE-2024-58135

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.