The vulnerability in CGI::Session::ID::md5 prior to version 4.49 arises from its generate_id method, which creates session identifiers by hashing a combination of the process ID, epoch time, and Perl's built-in rand() function using MD5. Each of these inputs is predictable or has low entropy: the process ID is from a small range, the epoch time can be guessed or obtained from HTTP headers, and Perl's rand() is predictable and reversible. This predictability allows an attacker to guess valid session IDs, leading to possible session hijacking and unauthorized access.

An attacker who can predict session IDs may impersonate legitimate users by hijacking their sessions, thereby bypassing authentication controls. This compromises the confidentiality and integrity of user sessions managed by the affected CGI::Session::ID::md5 versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to version 4.49 or later once available or apply any official fixes provided by the vendor. Until then, consider using alternative session ID generators with cryptographically secure randomness.