CVE-2026-5088

OVERVIEW CVE-2026-5088 affects Apache::API::Password for Perl through version 0.5.2 and involves insecure random salt generation for password hashing. The vulnerability occurs in the _make_salt and _make_salt_bcrypt methods, which attempt to use cryptographically secure random sources (Crypt::URandom or Bytes::Random::Secure) but fall back to Perl's built-in rand function if neither module is available. Since Perl's rand function is unsuitable for cryptographic purposes, this fallback mechanism can result in weak, predictable salts that compromise password security. SEVERITY The vulnerability carries a CVSS 3.1 score of 7.5 (HIGH) with a network-based attack vector, low attack complexity, no privilege requirements, and no user interaction needed. The primary impact is confidentiality compromise, as weak salts significantly reduce the computational cost of cracking password hashes through rainbow tables or brute force attacks. While integrity and availability are not directly affected, the compromise of hashed passwords represents a substantial security risk. EXPLOITATION STATUS There is no evidence of active exploitation, as CVE-2026-5088 does not appear on the Known Exploited Vulnerabilities catalog and is listed as inactive on threat tracking lists. The EPSS score of 0.00047 indicates this vulnerability ranks below the 99.86th percentile in likelihood of exploitation. No publicly available exploit code has been reported, and community attention appears minimal, though organizations using affected versions should nevertheless prioritize patching to secure password infrastructure.