SafeLine versions through 9.4.1 use a time-seeded math/rand pseudo-random number generator to derive the management console session-signing secret. Because this PRNG is cryptographically weak and seeded with predictable data (time), attackers who can bound the install timestamp can regenerate the secret offline. This enables forging of administrator session cookies without authentication, leading to unauthorized administrative access to protected sites.

An attacker who can estimate the installation time of SafeLine can reconstruct the session-signing secret offline. This allows forging of valid administrator session cookies, resulting in unauthorized administrative control over protected sites. The vulnerability is critical due to the high impact on confidentiality, integrity, and availability of the affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the management console and monitor for suspicious session activity. Avoid relying on the current session-signing mechanism and consider additional layers of authentication or session validation.