This vulnerability causes session identifiers to be logged in plaintext to a Statsd daemon when the communication channel is not secured. The flaw, an instance of improper handling of secrets (CWE-319), allows an attacker to capture session IDs, which can then serve as authentication tokens to impersonate users.

The issue appears in Catalyst::Plugin::Statsd versions through 0.10.0 and, to a different extent, in Plack::Middleware::Statsd 0.9.0 or later when insecurely configured. The affected vendor is RRWO.

Because the statistics are transmitted via UDP to a remote host, an attacker who can sniff this traffic can trivially retrieve session IDs. The vulnerability is not listed in KEV and has an EPSS score of <1%, but the potential to gain unauthenticated access through intercepted IDs marks this as a high‑risk security problem, especially if the Statsd endpoint resides on an external network. The vulnerability can be exploited without any specialized privileges by merely observing network traffic to the Statsd server.