Stateful session bean identifiers are generated using a non-cryptographically secure random source, allowing a remote attacker with a valid identifier to derive others and access or modify other users' session state. Upgrading to versions 10.3.0 or 11.0.0-M2 mitigates this issue.