CVE-2026-46473

Published: May 21, 2026Modified: Jul 23, 2026Deferred

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Authen::TOTP versions before 0.1.1 for Perl generate secrets using rand. Secrets were generated using Perl's built-in rand function, which is predictable and unsuitable for security usage.

Related CWEs

CWE-331

Insufficient Entropy

The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

References (3)

https://github.com/tchatzi/Authen-TOTP/commit/d04f30cc6538d77fc6b6d550da450cf3017b8561.patch

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

https://metacpan.org/release/TCHATZI/Authen-TOTP-0.1.1/changes

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

http://www.openwall.com/lists/oss-security/2026/05/21/15

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.