The vulnerability arises from the generate_session_id function, which uses low‑entropy sources when /dev/urandom is unavailable. The resulting session identifiers are predictable, allowing an attacker to guess or reproduce a session ID and impersonate a legitimate user. This compromise can lead to unauthorized access, session hijacking, and potentially full compromise of the web application. The weakness is a cryptographic random number generation fault, reflected in CWE‑338 and CWE‑340.

Vulnerable software is the TOKUHIROM Amon2::Plugin::Web::CSRFDefender module for Perl, versions 7.00 through 7.03 inclusive. These versions are part of the Amon2 web framework and have been deprecated by the author. Systems running any of these releases are susceptible to the insecure session ID flaw.

The CVSS base score of 5.3 indicates a moderate impact, while the EPSS score of less than 1% suggests low exploitation likelihood in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would typically be carried out remotely against the web application, requiring limited prerequisites beyond the presence of an inconsistent random source. Attackers could read HTTP headers such as Date to narrow the epoch and use predictable DST to reconstruct the ID.