CVE-2025-40933

Name of the Vulnerable Software and Affected Versions Apache::AuthAny::Cookie versions 0.201 and earlier

Description The software generates session IDs insecurely using an MD5 hash of the epoch time and the rand function. The epoch time may be guessable if not concealed by the HTTP Date header, and the rand function is not suitable for cryptographic purposes. Predictable session IDs could allow an attacker to gain unauthorized access to systems.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.