Plack::Middleware::Session::Simple before 0.05 creates session identifiers by hashing a value that includes the result of Perl's built-in rand function, the current time, and the process ID. The rand function is not cryptographically secure, and the time and PID values are small or guessable, so the resulting SHA‑1 hash is predictable. An attacker who can guess a valid session id can impersonate a user or hijack an existing session, gaining whatever privileges the legitimate session holds. Therefore this weakness constitutes a critical flaw that directly exposes confidentiality and integrity of user sessions.

The vulnerability affects the Perl module Plack::Middleware::Session::Simple from vendor KAZEBURO. All releases prior to 0.05 are impacted. The advisory also notes that Plack::Middleware::Session, which has a similar flaw (CVE‑2025‑40923), is fixed in version 0.35. Systems that rely on older versions of these modules are at risk.

The CVSS base score of 9.8 signals critical severity, and the EPSS score of <1% indicates a low but not negligible likelihood of exploitation in the wild. The module is not listed in the CISA KEV catalog, so no known public exploit has been reported yet. However, because the session ids are generated using low‑entropy data, an attacker can predict them with limited effort, especially if the HTTP Date header leaks the epoch time. Consequently the risk remains high, and rapid mitigation is recommended.