Apache AppSamurai Util up to version 1.01 generates session authentication keys using only the current time and the process ID, producing 64‑character hex strings that are largely deterministic. Because the first microsecond of a high‑resolution timestamp and the process ID are within a small, predictable range, an attacker who can estimate the creation moment of a session is able to enumerate a limited set of candidate keys. Using a valid key, the attacker can forge the session cookie, bypass authentication, and access protected resources, effectively compromising confidentiality and integrity of user data.

All installations of Apache AppSamurai Util for Perl through version 1.01 are affected. The module has not been updated since 2008 and is no longer maintained, so organizations using this legacy component run an unpatched vulnerability.

The vulnerability has a CVSS score of 3.7, categorizing it as low severity. The EPSS score is less than 1 % and the issue is not listed in CISA’s KEV catalog. Attackers may exploit the predictability of session keys if they can approximate the second a session was created and identify the worker process ID, enabling enumeration of potential keys that, when matched against the server, would allow forging of session cookies and bypass authentication. Although the key space is small, the deterministic algorithm makes enumeration feasible, so the risk of exploitation remains tangible, albeit lower than in higher‑severity cases.