Executive brief
Solstice::Session is a Perl library used to manage user sessions in web applications. A security flaw in how it creates session identifiers makes them predictable to attackers. This could allow an unauthorized person to guess a valid session ID and gain full access to a user's account or the underlying system.
Technical details
The vulnerability exists in the _generateSessionID method of Solstice::Session (and _generateID in Solstice::Subsession), which generates session IDs using an MD5 digest of predictable inputs. The seed includes the epoch time (often available in HTTP headers), a stringified hash reference, the process ID, and the output of Perl's built-in rand() function. Because rand() is seeded with only 16-bits and the other components are easily guessed or leaked, the resulting session IDs are cryptographically weak. An attacker can brute-force or predict these IDs to hijack active sessions without authentication. No patch is currently specified in the advisory, but the use of cryptographically secure PRNGs like Crypt::URandom is recommended for remediation.
Affected products
- Solstice Solstice::Session through 1440
- Solstice Solstice::Subsession through 1440
Timeline
- 2026-04-13: disclosed: Advisory published on oss-security mailing list
- 2026-04-13: advisory: NVD publication date