The vulnerability in Amon2 before version 6.17 arises from the random_string function's reliance on weak randomness sources when /dev/urandom is unavailable. Versions 6.06 to 6.16 attempt to generate random bytes by hashing a combination of the built-in rand() output, process ID, and high-resolution epoch time. Since these inputs are predictable or guessable, the resulting random strings can be predicted. Prior to 6.06, no fallback exists if /dev/urandom is missing, and before 6.04, the function solely used the built-in rand() for generating alphanumeric strings. This weakness affects security-critical functions such as session ID generation, cookie signing/encryption, and CSRF token creation, potentially compromising confidentiality, integrity, and availability.

The vulnerability allows attackers to predict security tokens generated by the random_string function, including session IDs, cookie signing/encryption secrets, and CSRF tokens. This can lead to session hijacking, forgery of authenticated requests, and compromise of user data integrity and confidentiality. The CVSS score of 9.8 reflects critical impact on confidentiality, integrity, and availability with network attack vector and no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid running Amon2 versions prior to 6.17 in environments where /dev/urandom may be unavailable or consider applying custom patches to ensure cryptographically secure randomness. Using external cryptographic libraries for random number generation is recommended as a temporary mitigation.