Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2026-46474: Trog::TOTP: Predictable Secrets Generated for Perl Users
CVE-2026-46474 · published 5 months ago
Summary
Trog::TOTP for Perl generates secrets in a way that can be easily guessed, which makes it insecure. This affects users who rely on Trog::TOTP for authentication or other security purposes. To fix this, update to version 1.006 or later.
Original advisory text
Trog::TOTP versions before 1.006 for Perl generate secrets using rand.
Secrets were generated using Perl's built-in rand function, which is predictable and unsuitable for security usage.
Trog::TOTP versions before 1.006 for Perl generate secrets using rand.
Secrets were generated using Perl's built-in rand function, which is predictable and unsuitable for security usage.
Secrets were generated using Perl's built-in rand function, which is predictable and unsuitable for security usage.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
7.5
High
Type
CWE-331Insufficient Entropy
Timeline
Published15 May 2026
Updated31 Oct 2026
First seen15 May 2026
Sources
CVE-2026-46474 · NVD
Track software like this
Free during beta