CVE-2026-5081: CWE-340 Generation of Predictable Numbers or Identifiers in CHORNY Apache::Session::Generate::ModUniqueId
Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure. Apache::Session::Generate::ModUniqueId (added in version 1.54) uses the value of the UNIQUE_ID environment variable for the session id. The UNIQUE_ID variable is set by the Apache mod_unique_id plugin, which generates unique ids for the request. The id is based on the IPv4 address, the process id, the epoch time, a 16-bit counter and a thread index, with no obfuscation. The server IP is often available to the public, and if not available, can be guessed from previous session ids being issued. The process ids may also be guessed from previous session ids. The timestamp is easily guessed (and leaked in the HTTP Date response header). The purpose of mod_unique_id is to assign a unique id to requests so that events can be correlated in different logs. The id is not designed, nor is it suitable for security purposes.
AI Analysis
Technical Summary
The vulnerability in Apache::Session::Generate::ModUniqueId (starting from version 1.54) arises because it uses the UNIQUE_ID environment variable set by Apache's mod_unique_id plugin as the session ID. The UNIQUE_ID is constructed from predictable elements including the server's IPv4 address, process ID, epoch time, a 16-bit counter, and thread index, without any obfuscation or cryptographic protection. Since these components can be guessed or inferred from public information or previous session IDs, the session IDs are predictable and thus insecure for security-sensitive use cases. The mod_unique_id plugin is intended only for request correlation in logs, not for generating secure session identifiers.
Potential Impact
An attacker can predict or guess valid session IDs due to the predictable nature of the UNIQUE_ID-based session identifiers. This can lead to session fixation or impersonation attacks, compromising confidentiality and integrity of user sessions. The vulnerability has a CVSS score of 9.1 (critical) with high confidentiality and integrity impact and no required privileges or user interaction for exploitation.
Mitigation Recommendations
No official patch or fix is currently available as per the vendor advisory. Users should avoid using Apache::Session::Generate::ModUniqueId for security-sensitive session ID generation. Instead, use a secure, cryptographically strong session ID generator. Monitor the vendor advisory for updates or official fixes.
CVE-2026-5081: CWE-340 Generation of Predictable Numbers or Identifiers in CHORNY Apache::Session::Generate::ModUniqueId
Description
Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure. Apache::Session::Generate::ModUniqueId (added in version 1.54) uses the value of the UNIQUE_ID environment variable for the session id. The UNIQUE_ID variable is set by the Apache mod_unique_id plugin, which generates unique ids for the request. The id is based on the IPv4 address, the process id, the epoch time, a 16-bit counter and a thread index, with no obfuscation. The server IP is often available to the public, and if not available, can be guessed from previous session ids being issued. The process ids may also be guessed from previous session ids. The timestamp is easily guessed (and leaked in the HTTP Date response header). The purpose of mod_unique_id is to assign a unique id to requests so that events can be correlated in different logs. The id is not designed, nor is it suitable for security purposes.
CVSS v3.1
Score 9.1critical
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Apache::Session::Generate::ModUniqueId (starting from version 1.54) arises because it uses the UNIQUE_ID environment variable set by Apache's mod_unique_id plugin as the session ID. The UNIQUE_ID is constructed from predictable elements including the server's IPv4 address, process ID, epoch time, a 16-bit counter, and thread index, without any obfuscation or cryptographic protection. Since these components can be guessed or inferred from public information or previous session IDs, the session IDs are predictable and thus insecure for security-sensitive use cases. The mod_unique_id plugin is intended only for request correlation in logs, not for generating secure session identifiers.
Potential Impact
An attacker can predict or guess valid session IDs due to the predictable nature of the UNIQUE_ID-based session identifiers. This can lead to session fixation or impersonation attacks, compromising confidentiality and integrity of user sessions. The vulnerability has a CVSS score of 9.1 (critical) with high confidentiality and integrity impact and no required privileges or user interaction for exploitation.
Mitigation Recommendations
No official patch or fix is currently available as per the vendor advisory. Users should avoid using Apache::Session::Generate::ModUniqueId for security-sensitive session ID generation. Instead, use a secure, cryptographically strong session ID generator. Monitor the vendor advisory for updates or official fixes.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CPANSec
- Date Reserved
- 2026-03-28T19:10:32.393Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-5081","vendor":"Red Hat"}]
Threat ID: 69fb3ce0cbff5d8610e47d86
Added to database: 05/06/2026, 13:06:40 UTC
Last enriched: 07/15/2026, 09:32:19 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 136
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.