Executive brief
Apache::AppSamurai::Util is a Perl library used to manage authenticated sessions in web applications. An attacker who knows the approximate time and worker process ID when a session was created can enumerate and predict session authentication keys, potentially bypassing login to steal or impersonate user accounts.
Technical details
Apache::AppSamurai::Util versions through 1.01 generate session authentication keys using a predictable algorithm in the CreateSessionAuthKey function. The key derivation runs five rounds of SHA-256 over Time::HiRes readings (formatted to microsecond precision), a running digest, and the process ID. Since the microsecond field takes only ~1 million values, later readings follow within microseconds, and process IDs are limited, an attacker with knowledge of the creation time window and worker PID can enumerate candidate keys. The cookie is returned to the browser and combined with the server key to compute the session ID; validation requires checking each candidate against the server's authentication mechanism, which does not reveal the server key.
Affected products
- Apache AppSamurai::Util through 1.01
Timeline
- 2026-08-23: disclosed