CVE-2026-46473 - Vulnerability Details - OpenCVE

Authen::TOTP versions before 0.1.1 for Perl generate secrets using rand.

Secrets were generated using Perl's built-in rand function, which is predictable and unsuitable for security usage.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

TCHATZI

Authen::TOTP

unaffected

Version	Status	Constraints
`0`	affected	< 0.1.1

No data.

No data.

No data.

Project Subscriptions

No data.

Advisories

No advisories yet.

Fixes

Solution

Upgrade to version 0.1.1 or later.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/tchatzi/Authen-TOTP/commit/d04f30cc6538d77fc6b6d550da450cf3017b8561.patch
https://metacpan.org/release/TCHATZI/Authen-TOTP-0.1.1/changes

History

Thu, 21 May 2026 20:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 21 May 2026 19:15:00 +0000

Type	Values Removed	Values Added
Description		Authen::TOTP versions before 0.1.1 for Perl generate secrets using rand. Secrets were generated using Perl's built-in rand function, which is predictable and unsuitable for security usage.
Title		Authen::TOTP versions before 0.1.1 for Perl generate secrets using rand
Weaknesses		CWE-331
References		https://github.com/tchatzi/Authen-TOTP/commit/d04f30cc6538d77fc6b6d550da450cf3017b8561.patch https://metacpan.org/release/TCHATZI/Authen-TOTP-0.1.1/changes

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: CPANSec

Published: 2026-05-21T18:53:18.547Z

Updated: 2026-05-21T19:18:00.347Z

Reserved: 2026-05-14T17:55:07.623Z

Link: CVE-2026-46473

Vulnrichment

Updated: 2026-05-21T19:16:51.459Z

NVD

Status : Received

Published: 2026-05-21T19:16:53.510

Modified: 2026-05-21T20:16:14.203

Link: CVE-2026-46473

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-331

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46473", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-05-14T17:55:07.623Z", "datePublished": "2026-05-21T18:53:18.547Z", "dateUpdated": "2026-05-21T19:18:00.347Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Authen-TOTP", "product": "Authen::TOTP", "programFiles": ["lib/Authen/TOTP.pm"], "programRoutines": [{"name": "Authen::TOTP::gen_secret"}], "repo": "https://github.com/tchatzi/Authen-TOTP", "vendor": "TCHATZI", "versions": [{"lessThan": "0.1.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Authen::TOTP versions before 0.1.1 for Perl generate secrets using rand.\n\nSecrets were generated using Perl's built-in rand function, which is predictable and unsuitable for security usage."}], "impacts": [{"capecId": "CAPEC-114", "descriptions": [{"lang": "en", "value": "CAPEC-114 Authentication Abuse"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-331", "description": "CWE-331 Insufficient Entropy", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-05-21T18:53:18.547Z"}, "references": [{"tags": ["release-notes"], "url": "https://metacpan.org/release/TCHATZI/Authen-TOTP-0.1.1/changes"}, {"tags": ["patch"], "url": "https://github.com/tchatzi/Authen-TOTP/commit/d04f30cc6538d77fc6b6d550da450cf3017b8561.patch"}], "solutions": [{"lang": "en", "value": "Upgrade to version 0.1.1 or later."}], "source": {"discovery": "UNKNOWN"}, "title": "Authen::TOTP versions before 0.1.1 for Perl generate secrets using rand", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-05-21T19:17:39.999382Z", "id": "CVE-2026-46473", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-21T19:18:00.347Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-46473", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-21T19:17:39.999382Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-21T19:16:51.459Z"}}], "cna": {"title": "Authen::TOTP versions before 0.1.1 for Perl generate secrets using rand", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-114", "descriptions": [{"lang": "en", "value": "CAPEC-114 Authentication Abuse"}]}], "affected": [{"repo": "https://github.com/tchatzi/Authen-TOTP", "vendor": "TCHATZI", "product": "Authen::TOTP", "versions": [{"status": "affected", "version": "0", "lessThan": "0.1.1", "versionType": "custom"}], "packageName": "Authen-TOTP", "programFiles": ["lib/Authen/TOTP.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Authen::TOTP::gen_secret"}]}], "solutions": [{"lang": "en", "value": "Upgrade to version 0.1.1 or later."}], "references": [{"url": "https://metacpan.org/release/TCHATZI/Authen-TOTP-0.1.1/changes", "tags": ["release-notes"]}, {"url": "https://github.com/tchatzi/Authen-TOTP/commit/d04f30cc6538d77fc6b6d550da450cf3017b8561.patch", "tags": ["patch"]}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "Authen::TOTP versions before 0.1.1 for Perl generate secrets using rand.\n\nSecrets were generated using Perl's built-in rand function, which is predictable and unsuitable for security usage."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-331", "description": "CWE-331 Insufficient Entropy"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-05-21T18:53:18.547Z"}}}, "cveMetadata": {"cveId": "CVE-2026-46473", "state": "PUBLISHED", "dateUpdated": "2026-05-21T19:18:00.347Z", "dateReserved": "2026-05-14T17:55:07.623Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-05-21T18:53:18.547Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}