A critical vulnerability in the Apache::AuthAny::Cookie Perl module allows unauthenticated attackers to predict session identifiers, leading to unauthorized account access.

The software uses the MD5 hash of the epoch time and the non-cryptographic rand function to generate session identifiers. This implementation is insecure and permits an unauthenticated attacker to guess valid session IDs.

Successful exploitation allows an attacker to hijack user sessions without requiring credentials, leading to full unauthorized access to protected resources. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to data confidentiality and internal system integrity.

Immediate Action: There is no official patch currently available; administrators should transition to a more secure authentication mechanism or implement session management alternatives that utilize cryptographically secure pseudo-random number generators.

Proactive Monitoring: Review web server and application logs for anomalous session patterns, such as rapid successful logins from disparate IP addresses or unexpected session token reuse.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and validate session cookies for high-entropy characteristics, and enforce strict session timeouts to reduce the window of opportunity for token prediction.

Public Exploit Available: exploit_available (unknown)

This vulnerability represents a significant architectural weakness in how session tokens are secured within the affected Perl module. Because the generation logic is inherently predictable, organizations currently utilizing Apache::AuthAny::Cookie should prioritize migrating to a secure, industry-standard authentication framework to eliminate the risk of session hijacking.