Plack-Middleware-Session versions prior to 0.35 for Perl generate session IDs using an insecure method. The default session ID generator uses a SHA-1 hash seeded with the built-in rand function, epoch time, and process ID (PID). Because the PID is from a small range and the epoch time may be guessable or leaked, the session IDs are predictable. This vulnerability could allow attackers to guess session IDs and gain unauthorized access.