CVE-2026-19565: CWE-341 Predictable from Observable State

The vulnerability in Apache::AppSamurai::Util (<=1.01) involves the CreateSessionAuthKey function generating session authentication keys based on the current time with microsecond precision and the process ID. The key is produced by running five rounds of SHA-256 over fresh Time::HiRes readings and the process ID, resulting in a 64-character hex string used as a session cookie. Because the microsecond timestamp and process ID are drawn from small, predictable ranges, an attacker who knows the exact second of session creation and the process ID can enumerate candidate keys to recover the session cookie and bypass authentication. The server validates the cookie with a key unknown to the attacker, requiring trial attempts against the server to confirm guesses.

An attacker with knowledge of the session creation time and process ID can enumerate possible session authentication keys and recover the victim's session cookie. This enables bypassing authentication to access protected resources. The impact is limited to confidentiality (session cookie exposure) and does not affect integrity or availability. The CVSS score is 3.7 (low), reflecting the difficulty of exploitation due to the need for precise timing and process ID knowledge and the requirement to test candidates against the server.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to trusted users and monitoring for suspicious authentication attempts. Avoid relying on predictable values such as process ID and timestamps for session key generation.