The WebDyne::Session module for Perl generates session IDs by hashing data seeded from the built-in rand() function, which is seeded with a 32-bit value derived from process ID, epoch time, and object reference address. However, this seeding approach does not improve the randomness quality, making the session IDs predictable. Because rand() is not cryptographically secure, attackers could potentially predict session IDs and gain unauthorized access. This issue affects versions through 2.075. No official fix or patch has been documented at this time.

Predictable session IDs weaken the security of session management, potentially allowing attackers to hijack sessions or impersonate legitimate users. The CVSS score of 6.5 (medium severity) reflects the network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality and integrity impact. There is no indication of availability impact or known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing alternative session ID generation methods that use cryptographically secure random number generators. Avoid relying on the built-in rand() function for security-sensitive randomness.