CVE-2026-5083

CVE-2026-5083 affects Ado::Sessions for Perl through version 0.935, a web framework component that generates cryptographically weak session identifiers using SHA-1 hashing seeded with insufficient entropy sources including the predictable built-in rand function, system epoch time, and process ID. The vulnerability permits attackers to predict valid session IDs and potentially hijack user sessions to gain unauthorized system access. Ado is no longer actively maintained and has been removed from the official CPAN repository, though legacy versions remain available on BackPAN. The vulnerability carries a CVSS 3.1 score of 5.3 (Medium) with a network-based attack vector requiring no authentication or user interaction, indicating relatively straightforward exploitation from remote sources. However, the impact is limited to loss of integrity with no direct confidentiality or availability impact noted in the official severity rating. The EPSS score of 0.00017 suggests this vulnerability has minimal probability of exploitation in the wild compared to other disclosed CVEs. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog and shows no evidence of active exploitation. No public exploit code has achieved mainstream attention, and community engagement remains minimal, likely due to the project's discontinued status and limited modern deployment footprint. Organizations using legacy Ado implementations should prioritize migration to actively maintained alternatives as the primary remediation strategy.