The _generateSessionID method in Solstice::Session and its counterpart in Solstice::Subsession produce session identifiers by concatenating the current epoch time, a stringified hash reference, the built‑in rand() function, and the process ID, then hashing the result with MD5. Because the epoch time can be guessed, the hash reference is deterministic, rand() provides only 16 bits of entropy, and process IDs are drawn from a small set, the resulting token is highly predictable. This weakness enables an attacker to guess valid session identifiers and impersonate legitimate users, thereby gaining unauthorized access to protected resources. The flaw falls under the weaknesses of predictable random number generation (CWE‑338) and inadequate entropy sources (CWE‑340).

All releases of the Solstice::Session module up to and including version 1440 distributed by MCRAWFOR on CPAN are affected. The Solstice::Subsession module, which shares the same token generation logic, is also vulnerable. Applications that rely on these modules for session handling are at risk, and no later release is documented that resolves the issue.

The CVSS score of 9.1 classifies the vulnerability as critical, indicating that successful exploitation results in full system compromise. The EPSS score of less than 1% suggests that, at present, the likelihood of exploitation is low, but the high severity still demands attention. The flaw does not appear in the CISA Known Exploited Vulnerabilities catalog, implying no publicly documented exploits yet. A likely attack vector is a remote network attacker who can observe or guess session identifiers transmitted in cookies or URLs. Because the token is based on components that can be predicted or brute‑forced, an attacker can attempt to guess a valid session ID with minimal effort, especially if the HTTP Date header exposes the epoch time or if the application logs session IDs in a way that is readable to the attacker. Successful guessing would allow session hijacking and full access to the victim's privileged state.