Session Hijacking in Urwid Web Backend

Developers relying on the urwid library for web-based terminal displays face a significant security hurdle following the disclosure of CVE-2026-9323. This flaw centers on how the web display backend manages session identifiers, potentially exposing user sessions to full takeover by local or remote adversaries.

Predictable Identifiers and PRNG Weakness

The vulnerability originates within the Screen.start() method, which constructs session tokens by concatenating two results from Python's random.randrange function. Because this implementation utilizes the Mersenne Twister pseudorandom number generator, it fails to meet the standards required for cryptographic security.

Attackers who monitor the X-Urwid-ID HTTP response header can collect a series of identifiers to reverse-engineer the generator's internal state. By observing approximately 334 session IDs, an adversary can reconstruct the PRNG state, allowing them to predict both historical and future session tokens with high accuracy.

Local File System Exposure Risks

Beyond remote prediction, the library introduces a secondary attack vector through its interaction with the host operating system. The session identifier is used to name a FIFO file generated within the /tmp directory, which is world-listable by default on many Unix-like systems.

Local users on the same host can simply list the directory to identify active session tokens. This creates an environment where any user with local access can bypass the need for sophisticated prediction logic by directly enumerating the existing session files.

Exploitation and System Control

Once an attacker obtains a valid session ID, the security boundary of the terminal session effectively collapses. The vulnerability allows an unauthorized party to interact with the victim's session through several methods:

• Reading the victim's terminal screen via the polling endpoint
• Injecting arbitrary keystrokes into the active session
• Executing OS-level commands under the victim's privileges
• Terminating or crashing the session by flooding the FIFO or sending exit sequences

Scope of the Security Incident

The following figures detail the technical severity and data requirements identified in the disclosure:

• Severity level: critical
• CVSS score: 8.1
• Samples needed for state reconstruction: 334
• PRNG state size: 19,937 bits

Implications for Terminal Security

This discovery suggests that developers using libraries for web-based terminal access must carefully audit how session tokens are generated. The fact that a Bandit S311 warning was previously suppressed indicates that these risks may have been overlooked during development, potentially leaving existing deployments exposed. For organizations, this means that even if a system appears isolated, local access or predictable identifier patterns could lead to full system compromise. Users of the library should prioritize remediating this behavior to prevent the potential for unauthorized code execution and session hijacking.