Security Advisory

CVE-2026-5088

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-04-15 07:03:13

Last updated 2026-05-01 16:03:43

Assigner CPANSec

CVSS score not scored

State PUBLISHED

Description

Apache::API::Password versions through 0.5.2 for Perl can generate insecure random values for salts. The _make_salt and _make_salt_bcrypt methods will attept to load Crypt::URandom and then Bytes::Random::Secure to generate random bytes for the salt. If those modules are unavailable, it will simply return 16 bytes generated with Perl's built-in rand function. The rand function is unsuitable for cryptographic use. These salts are used for password hashing.

← Browse all CVEs View on cve.org ↗