Versions of Solstice::Session up to 1440 generate session identifiers with insufficient entropy, combining the current epoch time, a stringified hash reference, Perl’s 16‑bit seeded rand() function, and the process ID, then hashing the result with MD5. This weakness is mapped to CWE‑338 and CWE‑340. The predictable session ids enable an attacker to guess or brute‑force valid identifiers, potentially gaining unauthorized access to protected resources and compromising confidentiality and integrity.

The vulnerability affects the Perl distribution MCRAWFOR:Solstice::Session, including all releases through version 1440. Users deploying these versions in web or application servers are at risk unless they upgrade beyond the affected release line.

The exploit likelihood is high because the deterministic elements make session IDs sufficiently predictable for an attacker. Although no CVSS score is provided, the absence of a known exploit (EPSS not available, not in KEV) does not mitigate the risk; the attack vector is inferred to be remote via HTTP or similar protocols where session tokens are transmitted. The impact could extend across the entire system if the session ID is used to authenticate a user or process.