CVE-2026-5087 affects PAGI::Middleware::Session::Store::Cookie versions through 0.001003, used in products like jjnapiork pagi, due to insecure generation of cryptographic Initialization Vectors (IVs) for session cookie encryption. This vulnerability arises when the module falls back to cryptographically weak random functions if `/dev/urandom` is unavailable. Rated High severity with a CVSS v3.1 score of 7.5 (AV:N/AC:L/C:H), it allows remote attackers to achieve high confidentiality impact by decrypting and tampering with sensitive session data. The attack requires low complexity and no user interaction or privileges. Currently, there is no evidence of active exploitation, nor are public exploits or Metasploit modules available, though it has received limited community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 0.001003CPE matchmatch criteria | cpe:2.3:a:jjnapiork:pagi\:\:middleware\:\:session\:\:store\:\:cookie:*:*:*:*:*:perl:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.