The session identifier generator in HTTP::Session2 uses the built‐in rand() function combined with the current epoch time and process ID. Because the PID comes from a small set of numbers and the epoch time may be inferred from an HTTP Date header, the resulting hash is far from cryptographically secure. An attacker who can guess or observe the epoch and PID has a high probability of predicting future session identifiers, enabling session fixation or hijacking of authenticated users.

All installations of TOKUHIROM’s HTTP::Session2 for Perl that run versions prior to 1.12 are affected. While the module attempts to use /dev/urandom from version 1.02 onward, the fallback to the insecure rand‑based method remains active if /dev/urandom is unavailable (for example on Windows). The module was formally deprecated in version 1.11, and users are encouraged to migrate to a different solution or update to 1.12 or later.

The CVSS base score of 6.5 indicates moderate severity, and the EPSS score of less than 1% suggests that exploitation attempts are uncommon at this time. The vulnerability is not listed in the CISA KEV catalog, which further limits the immediate threat headline. Nevertheless, an attacker with network visibility can exploit the weak randomness by predicting session IDs, provided they can monitor session creation traffic and, ideally, read the server’s HTTP Date header. The attack becomes feasible when the server falls back to the insecure method due to unavailability of /dev/urandom on the host system.