CVE-2026-19565 Overview
CVE-2026-19565 affects Apache::AppSamurai::Util versions through 1.01 for Perl. The module generates predictable session authentication keys inside CreateSessionAuthKey by hashing high-resolution clock readings and the worker process id. An attacker who knows the approximate second a session was created and the worker PID can enumerate candidate keys and recover the victim's session cookie. The weakness is categorized under CWE-341: Predictable from Observable State and impacts authentication for resources protected by the AppSamurai Apache authentication framework.
Critical Impact
Successful enumeration lets an unauthenticated network attacker reconstruct a valid session cookie and bypass authentication for protected resources.
Affected Products
- Apache::AppSamurai Perl module distribution on CPAN
- Apache::AppSamurai::Util versions through 1.01
- Apache deployments using CreateSession with the default empty Keysource
Discovery Timeline
- 2026-08-23 - CVE-2026-19565 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-19565
Vulnerability Analysis
The flaw sits in CreateSessionAuthKey, which produces a 64 hex character session authentication key. The function runs five rounds of SHA-256. Each round hashes a fresh Time::HiRes reading formatted to six decimal places, the running digest, and the process id. The output is returned to the browser as the session cookie. The server then combines the cookie with a configured server key to compute the session id and encrypt stored session data.
The entropy sources are shallow. The microsecond component of the first reading has roughly one million possible values. Subsequent readings fall within microseconds of the first. The worker process id is drawn from a small integer range on most Linux and BSD systems.
CreateSession calls CreateSessionAuthKey with an empty key source on every login. The optional Keysource directive is the only path to an alternate branch. Deployments relying on defaults therefore always hit the predictable code path.
Root Cause
The root cause is insecure random number generation. The module builds a security-critical secret from observable system state instead of a cryptographically secure random source such as /dev/urandom or Crypt::URandom. Time and PID are not secrets and do not add meaningful entropy for session key generation.
Attack Vector
An attacker who can approximate the second a session was created and the PID of the Apache worker enumerates the candidate microsecond values and PIDs. For each candidate the attacker reconstructs the SHA-256 chain and submits the resulting cookie to the server. The server validates the cookie using its own server key, so each guess requires an online request. The attack complexity is high because it depends on timing information and repeated authenticated probes, but success grants full session takeover.
Refer to the MetaCPAN Apache::AppSamurai Util Module source for the vulnerable CreateSessionAuthKey routine and the Openwall OSS-Security disclosure for the coordinator write-up.
Detection Methods for CVE-2026-19565
Indicators of Compromise
- High volumes of failed cookie validation attempts against AppSamurai-protected endpoints from a single source address or narrow IP range.
- Repeated authenticated requests using cookies that vary only in low-order bits, consistent with brute forcing candidate keys.
- Successful session use immediately following a burst of malformed session cookie submissions.
Detection Strategies
- Alert on any client that submits more than a small threshold of invalid session cookies to the AppSamurai handler within a short window.
- Correlate Apache worker PIDs from mod_log_config output with login timestamps to identify predictable session generation windows.
- Baseline normal cookie validation failure rates per source and flag statistical outliers.
Monitoring Recommendations
- Log the Apache worker PID and precise timestamp on every session creation event and retain these logs for forensic reconstruction.
- Monitor for concurrent sessions using the same session id from different source addresses.
- Forward Apache access and error logs to a centralized analytics platform for cross-request correlation.
How to Mitigate CVE-2026-19565
Immediate Actions Required
- Inventory Perl applications for Apache::AppSamurai and confirm the installed version of Apache::AppSamurai::Util.
- Replace the default empty key source by configuring a strong Keysource directive that supplies cryptographically random material.
- Rotate any existing session server keys and invalidate active sessions to force reauthentication.
Patch Information
At the time of NVD publication no fixed release of Apache::AppSamurai beyond 1.01 is available. Monitor the MetaCPAN release page and the Openwall OSS-Security thread for an updated distribution. Until then, operators must apply configuration workarounds or migrate off the module.
Workarounds
- Set the Keysource directive so CreateSessionAuthKey reads entropy from a secure source such as /dev/urandom rather than following the default time and PID branch.
- Front AppSamurai-protected applications with a reverse proxy that enforces short-lived sessions and strict rate limiting on cookie validation failures.
- Migrate authentication to an actively maintained Apache module, for example mod_auth_openidc, when a configuration fix is not feasible.
# Configuration example: force a strong Keysource for AppSamurai
# Apache httpd.conf snippet
PerlSetVar AppSamuraiKeysource "file:/etc/appsamurai/keysource.bin"
# Generate 256 bits of secure random material for the Keysource file
head -c 32 /dev/urandom > /etc/appsamurai/keysource.bin
chmod 600 /etc/appsamurai/keysource.bin
chown www-data:www-data /etc/appsamurai/keysource.bin
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
