The vulnerability is a predictable random number generator flaw that allows identical random streams to be produced across forked processes when a Bytes::Random::Secure::Tiny object is initialized before the fork. As a result, secrets or tokens generated by the affected module become deterministic and can be predicted by an adversary. This weakness is classified as CWE-335.

Vendors affected by this issue include DAVIDO, specifically the Bytes::Random::Secure::Tiny Perl module. All releases up through version 1.011 are impacted, meaning any installation of the module at these or earlier versions is vulnerable.

Because the flaw leads to predictable secrets, it can be exploited in any environment where the module is used in a multiprocess or forked context. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but its potential to compromise sensitive data suggests a significant confidentiality risk. An attacker who can control or observe forked processes may predict random values, leak credentials, or undermine cryptographic protocols that rely on this module.