The vulnerability in urwid's web display backend (urwid/display/web.py) arises from generating web session identifiers by concatenating two random.randrange(10**9) calls using Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes about 30 bits of PRNG state, and the full internal state is approximately 19,937 bits. Observing around 334 session IDs allows an attacker to reconstruct the PRNG state, enabling prediction of all past and future session IDs. Additionally, the session ID is used as the filename of a FIFO in the world-listable /tmp directory, allowing local users to enumerate active sessions. With a valid session ID, attackers can read terminal output, inject keystrokes to execute arbitrary code with the session owner's privileges, or disrupt the session by injecting exit sequences or flooding the FIFO. This issue was previously flagged by Bandit (S311) but was suppressed instead of remediated.

An attacker who obtains or observes enough session IDs can fully reconstruct the PRNG state, allowing prediction of all session identifiers. This enables unauthorized access to active sessions, including reading terminal output and injecting keystrokes, potentially leading to OS-level code execution with the session owner's privileges. Local users can also enumerate active sessions by listing the /tmp directory. The vulnerability thus allows both remote and local privilege escalation and session hijacking, posing a critical security risk.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict access to the /tmp directory to prevent local users from enumerating session FIFOs and avoid exposing session IDs in HTTP headers. Consider disabling or isolating the urwid web display backend in sensitive environments. Avoid relying on Python's Mersenne Twister PRNG for security-sensitive session identifiers.