Dancer2 versions through 2.1.0 for Perl generate insecure session ids when CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id when both Math::Random::ISAAC::XS and Crypt::URandom are unavailable. The fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function). These are all low-entropy and easily guessed sources. The built-in rand() function is seeded with 32-bits and considered unsuitable for security applications. Predictable session ids could allow an attacker to gain access to systems.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-13577 affects Dancer2 versions through 2.1.0, a popular Perl web framework, where session ID generation degrades to cryptographically insecure methods when preferred random number generators are unavailable. When both Math::Random::ISAAC::XS and Crypt::URandom modules are absent, the framework silently falls back to using Perl's built-in rand() function combined with predictable inputs like file paths, process IDs, and internal counters to generate session identifiers. This creates a critical authentication bypass risk, as attackers can predict or brute-force session IDs, potentially hijacking user sessions and gaining unauthorized access to sensitive functionality. Any organization running Dancer2-based applications in environments without the recommended CSPRNG modules—particularly containerized or minimal installations—faces elevated risk of session compromise.
While CVE-2026-13577 currently maps to CWE-338 (Use of Cryptographically Weak Pseudo-Random Number Generator) and CWE-340 (Generation of Predictable Numbers or Identifiers), Casky's 754 security skills can help practitioners identify the attack patterns and misconfigurations underlying this vulnerability. Security teams using Casky would examine application logs and dependency manifests for evidence of missing crypto modules, trace session token generation patterns for statistical weaknesses, and map the fallback behavior to technique patterns like T1021 (Remote Services exploitation via session hijacking). Extended reasoning through Claude AI would help practitioners correlate weak session entropy with authentication logs showing suspicious multi-session activity, rapid session enumeration attempts, or anomalous access patterns—signatures of session prediction attacks. Practitioners would also receive guidance on validating that production environments explicitly declare and verify cryptographic dependencies, ensuring the framework never silently degrades to insecure fallbacks.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-13577. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation