Executive brief
A cryptographic weakness allows session tokens used to authenticate users to web applications to be predicted by attackers. Because tokens lack sufficient randomness, an attacker can guess or forge valid session identifiers, potentially gaining unauthorized access to user accounts and sensitive operations without stealing legitimate credentials.
Technical details
The vulnerability stems from insufficient entropy in session token generation, causing tokens to be bounded by a limited seed space rather than true cryptographic randomness. An attacker can predict or enumerate valid session tokens by exploiting the weak random number generator (PRNG) used during token creation. This allows for session hijacking or token forgery without network eavesdropping, typically requiring only network access to the affected web application. The impact is confidentiality compromise through unauthorized session access. Patching requires replacing the weak PRNG with a cryptographically secure random source.
Timeline
- 2026-09-15: disclosed