CVE-2026-5088

The Apache::API::Password Perl module, in versions through 0.5.2 , is vulnerable to the use of a cryptographically weak pseudo-random number generator (PRNG) . Specifically, the _make_salt and _make_salt_bcrypt methods attempt to load Crypt::URandom and Bytes::Random::Secure for salt generation; ...

CVE-2026-5088 Apache::API::Password versions through 0.5.2 for Perl can generate insecure random values for salts

Apache::API::Password versions through 0.5.2 for Perl can generate insecure random values for salts. The makesalt and makesaltbcrypt methods will attept to load Crypt::URandom and then Bytes::Random::Secure to generate random bytes for the salt. If those modules are unavailable, it will simply...