Urwid Session Hijacking Vulnerability

A severe security vulnerability has been identified within the Urwid web display backend, potentially granting unauthorized actors full control over terminal sessions. The issue stems from the way the library generates identifiers for web-based displays, creating a path for session hijacking that bypasses standard security expectations.

Predictable Session Identifiers

At the core of the issue is the urwid/display/web.py module. The system generates web session identifiers, known as urwid_id, within the Screen.start() function by concatenating two results from Python's random.randrange(10**9) calls. Because these calls rely on the Mersenne Twister pseudo-random number generator (PRNG), the resulting identifiers are not cryptographically secure.

The deterministic nature of the Mersenne Twister means that if an attacker captures enough session IDs, they can reconstruct the internal state of the generator. Specifically, observing approximately 334 session IDs—often through the X-Urwid-ID HTTP response header—enables the prediction of all past and future session tokens assigned by the application.

Local File System Exposure

Beyond the cryptographic weakness, the library creates a direct path for local compromise. The generated urwid_id is used as a filename for a FIFO created within the world-listable /tmp directory. Any user on the same host can simply list the contents of that directory to enumerate active session tokens directly.

Impact on Execution

With a hijacked session ID, the risk to the host system is substantial. An attacker can:

• Read the victim's terminal screen via the polling endpoint.
• Inject arbitrary keystrokes into the session.
• Achieve OS-level code execution if the session is running a shell.
• Terminate or crash the session by flooding the FIFO or injecting exit sequences.

Key Vulnerability Data

• CVE-2026-9323 identifier assigned to the flaw.
• 8.1 CVSS severity score, categorized as critical.
• 19,937 bits represent the internal state of the Mersenne Twister.
• 30 bits are consumed by each PRNG call.

Implications for Security

The presence of this flaw highlights the danger of utilizing non-cryptographic PRNGs for security-sensitive operations. The source material notes that a previous Bandit S311 warning regarding this specific usage was suppressed with a # noqa: S311 comment rather than undergoing a technical remediation. For developers relying on this backend, the existence of these predictable identifiers suggests that any deployment currently using the web display feature may be susceptible to immediate session takeover by both local and remote adversaries.