Description
Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks. Catalyst::Plugin::Authentication does not automatically change the session id after authentication. An attacker that obtains a session id cookie can use this to impersonate the victim.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
ETHER Catalyst::Plugin::Authentication
Default version status: unaffected
0 to < 0.10_027affected
References
- https://metacpan.org/release/ETHER/Catalyst-Plugin-Authentication-0.10_027/changes ↗
- https://github.com/perl-catalyst/Catalyst-Plugin-Authentication/commit/b1385ea87a2491b64f33169222af19982d0acce3.patch ↗
- https://metacpan.org/pod/Catalyst::Plugin::Session#change_session_id ↗
- https://metacpan.org/pod/Plack::Middleware::Session#change_id ↗
- http://www.openwall.com/lists/oss-security/2026/06/09/10 ↗