CVE-2026-9323

A flaw was found in the urwid web display backend. This vulnerability arises from the use of a cryptographically insecure pseudo-random number generator (PRNG) for web session identifiers, making them predictable. An attacker could either observe enough session IDs to reconstruct the PRNG state or, if local, enumerate active session tokens from temporary files. Successful exploitation allows an attacker to read a victim's terminal screen, inject keystrokes leading to operating system-level code execution, or cause a denial of service by terminating the session.

The flaw is Important because predictable session identifiers in the urwid web display backend allow for remote code execution and information disclosure. Attackers can reconstruct the PRNG state by observing session IDs or enumerate active tokens from temporary files, leading to OS-level code execution with victim privileges.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, it is recommended to disable the urwid web display backend if its functionality is not essential for your environment. If the urwid web display backend must remain active, restrict network access to the service to trusted clients only by implementing appropriate firewall rules. This will limit the exposure to remote attackers attempting to reconstruct session IDs. Additionally, ensure that local system configurations prevent unauthorized access to temporary files, which could otherwise allow local users to enumerate active session tokens. Any changes to service configurations may require a service restart to take effect.