Apache::Session::Generate::MD5 produces session identifiers by hashing the output of Perl's built‑in rand() together with the current epoch time and a small set of process identifiers. The rand() function is not designed for cryptographic use, and the PID and epoch time can be guessed if not properly protected. This flaw aligns with CWE‑338 (Hard‑coded Cryptographic Key) and CWE‑340 (Use of Predictable Random Number Generation), leading to an attacker being able to predict valid session IDs and thereby impersonate legitimate users, gaining unauthorized access to web applications that rely on this module for session management.

The vulnerability affects the Apache::Session::Generate::MD5 module distributed by Chorny for Perl, for all releases up to and including version 1.94. Systems running Debian and other Linux distributions that include libapache-session-perl may contain a patched tree that uses Crypt::URandom, but unpatched deployments remain vulnerable.

The CVSS score of 9.1 indicates a high severity, while the EPSS score of less than 1% suggests a low current probability of exploitation. The vulnerability is not listed in CISA's KEV catalog. Because the session ID generator relies on predictable inputs, an attacker can remotely attempt to guess session IDs. If session identifiers are guessed correctly, session hijacking or privilege escalation may occur. The attack vector is most likely remote over HTTP/HTTPS, though disabling exposure of the Date header could reduce the predictability of the epoch component.