Description
Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default.
These predictable default secrets can be exploited by an attacker to forge session cookies. An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user’s session.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SRI | Mojolicious | 0.999922 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libmojolicious-perl | No fix yet | — |
| Debian 13 | libmojolicious-perl | No fix yet | — |
| Debian 12 | libmojolicious-perl | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libmojolicious-perl | No fix yet | — |
| Ubuntu 26.04 LTS | libmojolicious-perl | No fix yet | — |
| Ubuntu 25.10 | libmojolicious-perl | No fix yet | — |
| Ubuntu 24.04 LTS | libmojolicious-perl | No fix yet | — |
| Ubuntu 22.04 LTS | libmojolicious-perl | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | libmojolicious-perl | No fix yet | — |
| Ubuntu 18.04 LTS | libmojolicious-perl | No fix yet | — |
| Ubuntu 16.04 LTS | libmojolicious-perl | No fix yet | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | perl-Test-Mojo +1 | 9.40-3.amzn2023.0.1 | ALAS2023-2025-985 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | perl-Mojolicious | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | perl-Mojolicious | No fix yet | — |
Advisories 1
- ALAS2023-2025-985 Important: perl-Mojolicious security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 2, 2025
References
- https://github.com/mojolicious/mojo/pull/1791 issue-tracking
- https://github.com/mojolicious/mojo/pull/2200 issue-tracking
- https://www.synacktiv.com/publications/baking-mojolicious-cookies technical-description
- https://medium.com/securing/baking-mojolicious-cookies-revisited-a-case-study-of-solving-security-problems-through-security-by-13da7c225802 technical-description
- https://metacpan.org/release/SRI/Mojolicious-9.39/source/lib/Mojolicious.pm#L51 related
- https://github.com/hashcat/hashcat/pull/4090 exploit
- https://lists.debian.org/debian-perl/2025/05/msg00016.html mailing-list
- https://lists.debian.org/debian-perl/2025/05/msg00017.html mailing-list
- https://lists.debian.org/debian-perl/2025/05/msg00018.html mailing-list
- https://github.com/mojolicious/mojo/pull/2252 issue-tracking
- https://docs.mojolicious.org/Mojolicious/Guides/FAQ#What-does-Your-secret-passphrase-needs-to-be-changed-mean technical-description