Apache::Session::Generate::ModUniqueId generates session identifiers from the UNIQUE_ID environment variable, which is composed of the client IP, process ID, epoch time, a counter, and a thread index, without any obfuscation. Because each element is predictable or can be guessed, an attacker who can observe or infer previously issued session IDs can construct future identifiers. When those session IDs are used for authentication or to grant access to restricted data, the vulnerability permits session hijacking, allowing an adversary to impersonate authenticated users.

Affected systems include CHORNY’s Apache::Session::Generate::ModUniqueId module, with versions 1.54 through 1.94 identified as vulnerable. Any Perl application that relies on this module for session ID generation, especially if the IDs are used for security decisions, is at risk unless the module is replaced or the session strategy is changed.

The CVSS score of 9.1 indicates a severe flaw that can lead to significant compromise. No EPSS probability is available, so the likelihood of exploitation is unknown but potentially high if session IDs are tied to authentication. The vulnerability is not listed in the CISA KEV catalog, yet its fundamental weakness in random number generation exposes a critical security gap. Attackers would typically target the web application from a network location, leveraging predictable session IDs to hijack user sessions and access protected resources.