Threats affecting pkg:github/Plack-Middleware-Session-Simple

CVE-2025-40926 is a critical vulnerability in Plack::Middleware::Session::Simple versions before 0.05 for Perl, where session IDs are generated using a predictable method. The default session ID generator uses a SHA-1 hash seeded with the built-in rand function, epoch time, and process ID (PID). Since the PID is from a small set of numbers and the epoch time can be guessed or leaked, the session IDs are predictable. This weakness can allow attackers to guess valid session IDs and potentially gain unauthorized access. The vulnerability has a CVSS score of 9.8, indicating a critical severity level. No patch or official fix information is provided in the available data.