Threats affecting pkg:github/Apache-Session-Browsable

CVE-2026-8503 is a medium severity vulnerability in Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl. The module generates session IDs using predictable, low-entropy sources such as the built-in rand() function, epoch time, and process ID, which are hashed with SHA-256. This predictability can allow attackers to guess session IDs and potentially gain unauthorized access. Version 1.3.19 includes a fallback to an insecure method only if Crypt::URandom::urandom fails, which is unlikely since Crypt::URandom is a required dependency. No official patch or remediation guidance is currently available.