Ado::Sessions versions through 0.935 for Perl produce session identifiers by hashing the output of Perl's built‑in rand() function together with the current epoch time and the process ID. Because rand() is not cryptographically secure, the PID comes from a limited set of numbers, and the epoch time can sometimes be inferred from the HTTP Date header, the resulting session IDs are low‑entropy and predictable. This weakness can allow an attacker to guess or brute‑force a valid session identifier, leading to unauthorized access to the application. The flaw is a classic instance of insufficient entropy in cryptographic material (CWE‑338) and predictable random number generation (CWE‑340).

Systems that use BEROV's Ado::Sessions module in any Perl application are affected, specifically any installation of versions 0.935 or earlier. The module is no longer maintained and has been removed from the CPAN index, but remains available on BackPAN. Any Perl project that includes or requires the Ado::Sessions library inherits the predictable session ID weakness.

The CVSS base score for this issue is 5.3, indicating moderate severity. The EPSS score is less than 1 %, suggesting a low probability of exploitation in the short term. The vulnerability is not listed in CISA's KEV catalog. The likely attack vector is an attacker attempting to guess or brute‑force session identifiers, potentially aided by exposure of the epoch time through HTTP headers or log data. Exploitation would require access to the affected application's session store or a server that shares the same process ID space.