Plack::Middleware::Session::Simple versions through 0.04 for Perl generates session ids insecurely.

The default session id generator returns a SHA-1 hash seede…

CVE-2025-40926 affects Plack::Middleware::Session::Simple versions through 0.04 for Perl, which generates session IDs insecurely using SHA-1 hash seeded with built-in rand function, epoch time, and PID. The vulnerability stems from using cryptographically weak random number generation, making session IDs predictable. Attackers could exploit predictable session IDs to gain unauthorized access to systems. The issue is similar to CVE-2025-40923 affecting the compatible Plack::Middleware::Session library.