CVE-2026-5081

Apache::Session::Generate::ModUniqueId versions 1.54 through 1.94 are vulnerable to insecure session ID generation. The module uses the UNIQUE_ID environment variable, which is populated by the Apache mod_unique_id plugin. The resulting identifiers are constructed from the server's IPv4 address, ...