Concierge::Sessions, a Perl module for generating session identifiers, exposes insecure IDs in releases 0.8.1 through 0.8.4. The generate_session_id routine first invokes the uuidgen command and, on failure, silently falls back to Perl’s rand() function. Neither mechanism provides cryptographic randomness: uuidgen without the --random switch generates time‑based UUIDs that embed the system clock, and Perl’s rand() is deterministic once seeded, enabling attackers to predict or brute‑force session identifiers that serve as full access tokens.

The affected product is BVA’s Concierge::Sessions library versions older than 0.8.5, as listed by the CNA. No other vendors or products are cited, so the impact is limited to applications that depend on this module.

The CVSS score of 9.8 marks this flaw as a high‑severity remote vulnerability, while the EPSS score of less than 1% indicates that exploitation is expected to remain low at the time of analysis. Despite this, the lack of a warning when uuidgen fails and the use of a predictable fallback let attackers potentially generate legitimate session IDs, effectively bypassing authentication. The combination of a top‑tier severity and an exploitable session hijack scenario demands vigilant monitoring and prompt remediation.