Solstice::Session versions through 1440 for Perl generate session identifiers insecurely by combining an MD5 digest seeded with predictable or low-entropy values: epoch time, a stringified hash reference, the built-in rand() function (which is seeded with only 16 bits), and the process ID. The same insecure method is used in Solstice::Subsession. Because these inputs can be guessed or predicted, session IDs are vulnerable to prediction attacks, potentially allowing unauthorized access. No CVSS score or vendor advisory is available, and no patch links are provided.

The vulnerability allows attackers to predict session IDs due to weak entropy in their generation. This can lead to session hijacking or unauthorized access to systems relying on Solstice::Session for session management. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing additional session management controls or replacing Solstice::Session with a more secure alternative that uses cryptographically secure random number generation for session IDs.