CVE-2026-15747

Deferred Deferred - Pending Action

Session Token Exposure via BREACH Attack in Mojolicious

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: CPANSec

Description

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. _csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden `csrf_token` input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle. An attacker able to query it can recover the token and pass csrf_protect validation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-15747

EUVD

EUVD-2026-44067

Affected Vendors & Products

Vendor	Product	Version / Range
mojolicious	mojolicious	From 4.59 (inc) to 9.48 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
CWE-204	The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

This vulnerability affects Mojolicious versions 4.59 to 9.47 for Perl. The _csrf_token function generates a single session token that is reused for every request, and _csrf_field embeds this token in hidden form fields. When responses containing this token include attacker-controlled input and are gzip-compressed, the BREACH attack can recover the token by analyzing compression length differences. This allows bypassing CSRF protection.

Detection Guidance

Detecting this vulnerability requires checking if your Mojolicious version is between 4.59 and 9.47. Inspect the version with commands like 'perl -MMojolicious -e "print $Mojolicious::VERSION"' or check installed modules via package managers. Monitor network traffic for repeated CSRF tokens in responses or unusual compression patterns in gzip responses.

Impact Analysis

An attacker could exploit this to recover the CSRF token and perform unauthorized actions on behalf of authenticated users. This could lead to account takeovers, data theft, or state-changing operations like password changes or financial transactions if the application relies on CSRF tokens for protection.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations may face compliance violations if user data is compromised due to insufficient CSRF protections.

Mitigation Strategies

Upgrade Mojolicious to version 9.48 or later immediately. Apply the patch from the official commit if upgrading is not feasible. Ensure CSRF tokens are regenerated per request and avoid gzip compression for responses containing sensitive tokens.

Hi! I’m here to help you understand CVE-2026-15747. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70