The vulnerability is a predictable random number generator flaw that allows identical random streams to be produced across forked processes when a Bytes::Random::Secure::Tiny object is initialized before the fork. As a result, secrets or tokens generated by the affected module become deterministic and can be predicted by an adversary. This weakness is classified as CWE-335.

Vendors affected by this issue include DAVIDO, specifically the Bytes::Random::Secure::Tiny Perl module. All releases up through version 1.011 are impacted, meaning any installation of the module at these or earlier versions is vulnerable.

Because the PRNG state is shared across processes when a Bytes::Random::Secure::Tiny object is initialized before fork, an attacker who can observe or influence multiple forked processes could anticipate the random output. The CVSS score of vulnerability has significant severity, while the EPSS of less than 1% points to a low probability of exploitation in practice. The issue is not listed in CISA KEV, suggesting no widespread documented exploits yet. Based on the description, it is inferred that predictable random streams may expose secrets or tokens generated in multi‑process applications, but specific impact on cryptographic protocols is not explicitly asserted in the CVE data.