ntopng through version 6.6 suffers from a predictable session identifier vulnerability (CWE-341) due to the use of weak time-seeded pseudo-randomness in HTTP session ID generation within src/HTTPserver.cpp. This weakness allows attackers to cause deterministic or colliding session cookies during fresh authenticated logins by controlling timing, potentially leading to session hijacking. The vulnerability has a CVSS 3.1 score of 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No official patch or remediation level is currently documented, and no known exploits are reported in the wild.

Successful exploitation can result in session hijacking, allowing attackers to impersonate authenticated users and gain unauthorized access to sensitive information or functionality. The vulnerability affects confidentiality, integrity, and availability of the affected system. Given the critical CVSS score, the impact is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing compensating controls such as restricting access to trusted networks or monitoring for suspicious session activity. Avoid relying on the affected versions for sensitive deployments.