CVE-2025-40915

CVE-2025-40915: Mojolicious::Plugin::CSRF 1.03 for Perl uses a weak random number source for generating CSRF tokens

Vendor Gryphon

Product Mojolicious::Plugin::CSRF

Weakness CWE-338

Published June 11, 2025

Last update June 11, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Mojolicious::Plugin::CSRF 1.03 for Perl uses a weak random number source for generating CSRF tokens. That version of the module generates tokens as an MD5 of the process id, the current time, and a single call to the built-in rand() function.

Key dates

02Disclosure timeline

June 11, 2025 CVE published

June 11, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-40915 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/338.html

Related vulnerabilities

04Related CVE

CVE-2024-58040 Crypt::RandomEncryption for Perl uses insecure rand() function during encryption CVE-2025-22376 CVE-2025-40905 WWW::OAuth 1.000 and earlier for Perl uses insecure rand() function for cryptographic functions CVE-2024-58036 Net::Dropbox::API 1.9 and earlier for Perl uses insecure rand() function for cryptographic functions CVE-2026-40514 SmarterTools SmarterMail < Build 9610 Cryptographic Weakness via Weak RNG