Apache AppSamurai Util up to version 1.01 generates session authentication keys using only the current time and the process ID, producing 64‑character hex strings that are largely deterministic. Because the first microsecond of a high‑resolution timestamp and the process ID are within a small, predictable range, an attacker who can estimate the creation moment of a session is able to enumerate a limited set of candidate keys. Using a valid key, the attacker can forge the session cookie, bypass authentication, and access protected resources, effectively compromising confidentiality and integrity of user data.

All installations of Apache AppSamurai Util for Perl through version 1.01 are affected. The module has not been updated since 2008 and is no longer maintained, so organizations using this legacy component run an unpatched vulnerability.

The vulnerability carries a very high severity because it allows direct authentication bypass. No EPSS score is available and it is not listed in CISA’s KEV catalog. The attack vector is local or remote depending on whether the attacker can determine the exact creation time of a session and the worker’s process ID. Given the small key space and the deterministic generation algorithm, enumeration is feasible and the risk of exploitation is substantial.