Amon2::Plugin::Web::CSRFDefender versions 7.00 through 7.03 generate session IDs insecurely when /dev/urandom is not accessible. The fallback method uses a SHA-1 hash seeded with the built-in rand() function, process ID (PID), and high-resolution epoch time. Since the PID is from a small range and the epoch time may be inferred (e.g., from HTTP Date headers), the session IDs can be predicted. The built-in rand() function is not cryptographically secure, making the session ID generation vulnerable to prediction. Earlier versions before 7.00 were also vulnerable due to a related issue (CVE-2025-15604). The module is deprecated, and no official fix or patch has been provided.

The vulnerability allows attackers to predict session IDs generated by the affected module under certain conditions, potentially undermining session integrity. However, the CVSS score of 5.3 (medium severity) and vector indicate no confidentiality or integrity impact, only a potential availability impact. There are no known exploits in the wild. The module's deprecation suggests it may no longer be maintained or recommended for use.

No official patch or remediation is currently available for this vulnerability. Since the module is deprecated, users should consider migrating to alternative, actively maintained CSRF defense solutions that use secure random number generation. Avoid relying on this module for session ID generation, especially in environments where /dev/urandom might be unavailable. Monitor vendor advisories for any future updates or recommendations.