CVE-2025-40933 - CVE House
Back to Database
Status published Unknown CVE-2025-40933

Apache::AuthAny::Cookie v0.201 or earlier for Perl generates session ids insecurely

Vulnerability Description

Apache::AuthAny::Cookie v0.201 or earlier for Perl generates session ids insecurely. Session ids are generated using an MD5 hash of the epoch time and a call to the built-in rand function. The epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-40933

Credits & Attribution

No credits recorded in the NVD database.

References

Affected Vendor

Affected Software

Apache::AuthAny
Vulnerable Versions:
0.19

Timeline

Official Publish: September 17th, 2025
Last Modified: September 17th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

CWE-340 CWE-338

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.