Executive brief
A component used to generate session identifiers for Perl-based web applications uses predictable data to create those IDs. Because these identifiers are easy to guess, an attacker could potentially hijack user sessions, gaining unauthorized access to private accounts or sensitive data. This affects applications using the Apache::Session library with the ModUniqueId generator.
Technical details
The Apache::Session::Generate::ModUniqueId module (versions 1.54-1.94) relies on the Apache 'UNIQUE_ID' environment variable to generate session IDs. This variable is composed of predictable elements including the server's IPv4 address, process ID, epoch timestamp, a 16-bit counter, and a thread index, all without obfuscation. Since the server IP is often public and the timestamp is leaked in HTTP headers, an attacker can predict valid session IDs. This vulnerability is classified as CWE-340 (Generation of Predictable Numbers or Identifiers). Users are advised to migrate to more secure alternatives like Apache::Session::Generate::Random.
Affected products
- Apache-Session (Perl) Apache::Session::Generate::ModUniqueId 1.54 through 1.94
Timeline
- 2026-05-06: disclosed: Initial disclosure via oss-security mailing list
- 2026-05-06: advisory: NVD publication date