Apache::Session::Generate::ModUniqueId generates session identifiers from the UNIQUE_ID environment variable, a flaw that corresponds to CWE-341, insecure random number generation, where the ID is composed of the client IP, process ID, epoch time, a counter, and a thread index, with no obfuscation. Because each element is predictable or can be guessed, an attacker who can observe or infer previously issued session IDs can construct future identifiers. When those session IDs are used for authentication or to grant access to restricted data, the vulnerability permits session hijacking, allowing an adversary to impersonate authenticated users.

Affected systems include CHORNY’s Apache::Session::Generate::ModUniqueId module, with versions 1.54 through 1.94 identified as vulnerable. Any Perl application that relies on this module for session ID generation, especially if the IDs are used for security decisions, is at risk unless the module is replaced or the session strategy is changed.

The CVSS score of 9.1 indicates a severe flaw that can lead to significant compromise. This weakness is classified as CWE-341, insecure random number generation, which means the session IDs can be predicted based on observable information. The EPSS score of 0.00029 indicates a very low but non‑zero probability of exploitation; however, because session IDs may be used for authentication, the risk remains pronounced. The vulnerability is not listed in the CISA KEV catalog, yet its fundamental weakness in random number generation exposes a critical security gap. Attackers would typically target the web application from a network location, leveraging predictable session IDs to hijack user sessions and access protected resources.