CVE-2026-13577 Dancer2 versions through 2.1.0 for Perl generate insecure session ids when CSPRNG modules are unavailable

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generateid silently falls back to a built-in rand-derived session id when both Math::Random::ISAAC::XS and Crypt::URandom are unavailable. The fallback...