CVE-2026-46474

Published: May 15, 2026Modified: Jun 17, 2026Deferred

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Trog::TOTP versions before 1.006 for Perl generate secrets using rand. Secrets were generated using Perl's built-in rand function, which is predictable and unsuitable for security usage.

Related CWEs

CWE-331

Insufficient Entropy

The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

References (3)

https://metacpan.org/release/TEODESIAN/Trog-TOTP-1.006/changes

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

https://metacpan.org/release/TEODESIAN/Trog-TOTP-1.006/diff/TEODESIAN/Trog-TOTP-1.005#lib/Trog/TOTP.pm

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

http://www.openwall.com/lists/oss-security/2026/05/15/18

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.