CVE-2025-40933
High
Description
Apache::AuthAny::Cookie v0.201 or earlier for Perl generates session ids insecurely. Session ids are generated using an MD5 hash of the epoch time and a call to the built-in rand function. The epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems.
SeverityHigh
CVSS7.5
Exploit probability—
ProductApache::AuthAny
PublishedSep 17, 2025
First seenSep 17, 2025
Weakness typeCWE-340CWE-340CWE-338CWE-338
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| KGOLDOV Apache::AuthAny | 0.19 ≤ v ≤ 0.201 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.