The vulnerability arises because WebDyne::Session uses an MD5 hash seeded with Perl's rand() function to generate session identifiers. The rand() seeds it with a 32‑bit value derived from the process ID, epoch time and the object reference address, yet the overall seed quality is poor because rand() is deterministic and unsuitable for cryptographic use. As a result, session identifiers are predictable; an attacker can calculate or brute‑force valid session IDs, impersonate users and gain unauthorized access. This flaw is classified as CWE‑338 and CWE‑340.

All Perl web applications that use the ASPEER WebDyne::Session module versions older than 3.003_704 are vulnerable. Additionally, earlier releases from a separate distribution—WebDyne::Session versions 1.042 and preceding—also lack the secure identifier generation. Any system importing these modules for session handling therefore inherits the predictable ID issue.

The CVSS score of 6.5 indicates moderate severity, but the EPSS score of <1% shows exploitation probability is low. The vulnerability is not listed in CISA KEV, suggesting no known public exploits. Nonetheless, a remote attacker can predict or brute‑force session IDs by replicating the deterministic rand() call, then hijack an active session or forge authentication. The affected code path is local: the session ID is produced by calling rand() with the process ID, time and reference address, hashing the result with MD5. Because rand() is reproducible, an attacker can generate the same seed and compute a valid session ID, leading to loss of confidentiality and integrity if successful.