PatchSiren

PatchSiren cyber security CVE debrief

CVE-2009-10007 ETHER CVE debrief

CVE-2009-10007 is a critical vulnerability in Catalyst::Plugin::Authentication versions before 0.10_027 for Perl. The plugin does not automatically change the session id after authentication, making it susceptible to session fixation attacks. An attacker who obtains a session id cookie can use this to impersonate the victim.

Vendor
ETHER
Product
Catalyst::Plugin::Authentication
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-09
Original CVE updated
2026-07-21
Advisory published
2026-06-09
Advisory updated
2026-07-21

Who should care

Users of Catalyst::Plugin::Authentication versions before 0.10_027 for Perl should be aware of this vulnerability and take steps to mitigate it.

Technical summary

Catalyst::Plugin::Authentication does not automatically change the session id after authentication. An attacker that obtains a session id cookie can use this to impersonate the victim.

Defensive priority

high

Recommended defensive actions

  • Upgrade to Catalyst::Plugin::Authentication version 0.10_027 or later.
  • Use a secure session management system that automatically changes the session id after authentication.
  • Implement additional security measures to protect against session fixation attacks.

Evidence notes

The CVE-2009-10007 vulnerability has a CVSS score of 9.1 and is classified as CRITICAL.

Sources and references

Verified primary and authoritative sources

  • CVE-2009-10007 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2009-10007

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2009-10007 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2009-10007

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://github.com/perl-catalyst/Catalyst-Plugin-Authentication/commit/b1385ea87a2491b64f33169222af19982d0acce3.patch

    9b29abf9-4ab0-4765-b253-1875cd9b441e

  • Source reference

    Unverified legacy reference

    URL: https://metacpan.org/pod/Catalyst::Plugin::Session

    9b29abf9-4ab0-4765-b253-1875cd9b441e

  • Source reference

    Unverified legacy reference

    URL: https://metacpan.org/pod/Plack::Middleware::Session

    9b29abf9-4ab0-4765-b253-1875cd9b441e

  • Source reference

    Unverified legacy reference

    URL: https://metacpan.org/release/ETHER/Catalyst-Plugin-Authentication-0.10_027/changes

    9b29abf9-4ab0-4765-b253-1875cd9b441e

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.