CVE-2026-13577: Dancer2 Perl Auth Bypass Vulnerability

CVE-2026-13577 Overview

CVE-2026-13577 affects Dancer2 versions through 2.1.0 for Perl. The framework generates insecure session identifiers when required cryptographically secure pseudo-random number generator (CSPRNG) modules are unavailable. The Dancer2::Core::Role::SessionFactory::generate_id function silently falls back to a rand-derived session ID unless both Math::Random::ISAAC::XS and Crypt::URandom are installed. Predictable session IDs allow attackers to guess valid sessions and gain unauthorized access to protected resources. This weakness is classified under CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator.

Critical Impact
Attackers can predict session identifiers and hijack authenticated user sessions on Dancer2 Perl web applications lacking the required CSPRNG dependencies.

Affected Products

Dancer2 for Perl, all versions through 2.1.0
Deployments missing Math::Random::ISAAC::XS
Deployments missing Crypt::URandom

Discovery Timeline

2026-07-20 - CVE-2026-13577 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-13577

Vulnerability Analysis

Dancer2 is a widely deployed lightweight web application framework for Perl. Session identifiers are used to authenticate returning users between HTTP requests. The generate_id method in Dancer2::Core::Role::SessionFactory is expected to produce identifiers that resist prediction by attackers.

When the recommended CSPRNG modules are absent, the method silently falls back to a weak alternative. It computes a SHA-1 hash over inputs derived from Perl's built-in rand function, the absolute file path of the module, an internal counter, the process ID, the module instance's memory address, and a character string shuffled with List::Util::shuffle. The shuffle function also relies on rand.

All of these inputs are low-entropy and largely guessable by a remote attacker who understands the environment. See the Dancer2 SessionFactory source on GitHub for the fallback logic.

Root Cause

The root cause is the silent fallback to Perl's built-in rand function. rand is seeded with only 32 bits of state and is not suitable for security-sensitive purposes. A SHA-1 hash over predictable inputs cannot introduce entropy that the underlying sources do not provide, so the resulting session IDs remain guessable.

Attack Vector

An unauthenticated network attacker can request a session from the target application to observe issued identifiers. Given the constrained entropy of rand, the attacker can reconstruct the internal state and predict future session IDs. Successful prediction lets the attacker impersonate authenticated users without credentials.

No verified public exploit code is available. The vulnerability mechanism is described in prose only; refer to the upstream source for technical details.

Detection Methods for CVE-2026-13577

Indicators of Compromise

Multiple successful session validations from a single source IP across distinct user accounts within a short time window.
Session IDs presented by clients that were never issued via a legitimate login flow.
Access to authenticated endpoints without a preceding authentication event in application logs.

Detection Strategies

Audit installed Perl modules on all Dancer2 hosts and flag any deployment missing Math::Random::ISAAC::XS or Crypt::URandom.
Inspect Dancer2 startup logs and dependency manifests for warnings about CSPRNG module availability.
Statistically analyze issued session IDs for low entropy or repeating patterns using a sampling script against staging traffic.

Monitoring Recommendations

Alert on abnormal ratios of authenticated requests to authentication events for each Dancer2 application.
Monitor web server access logs for high-volume session cookie enumeration attempts.
Track Perl module inventory changes in configuration management so missing CSPRNG dependencies trigger a security review.

How to Mitigate CVE-2026-13577

Immediate Actions Required

Install both Math::Random::ISAAC::XS and Crypt::URandom on every host running Dancer2.
Invalidate all existing sessions after installing the CSPRNG modules to purge weak identifiers.
Upgrade Dancer2 to a fixed release once available from the maintainers.

Patch Information

At the time of publication, review the CVE.org record for the related advisory and the Dancer2 upstream repository for the current patch status. Ensure Dancer2 aborts startup rather than silently falling back when CSPRNG modules are missing.

Workarounds

Force installation of Math::Random::ISAAC::XS and Crypt::URandom as hard dependencies in your application's cpanfile.
Configure Dancer2 to fail closed on startup if either CSPRNG module is unavailable rather than issuing weak session IDs.
Rotate session cookies frequently and bind sessions to client attributes such as IP address and user-agent to reduce the window for prediction attacks.

bash

# Install required CSPRNG modules for Dancer2
cpanm Math::Random::ISAAC::XS Crypt::URandom

# Verify both modules are present
perl -MMath::Random::ISAAC::XS -e 'print "ISAAC::XS OK\n"'
perl -MCrypt::URandom -e 'print "URandom OK\n"'