Critical Urwid Session Hijack Flaw Disclosed

A critical vulnerability, tracked as CVE-2026-9323 (GHSA-83x9-8wvq-rrcp), affects the Urwid web display backend by utilizing an insecure random number generator for session identifiers. With a CVSS score of 8.1, this flaw exposes users to unauthorized session access, keystroke injection, and potential OS-level code execution.

What's at Risk

The vulnerability exists within the urwid/display/web.py module, specifically in how the Screen.start() method handles the generation of urwid_id session tokens. Any organization or individual deploying applications that rely on the Urwid web backend for remote terminal access is potentially exposed.

Because these identifiers are used both as web session tokens and as filenames for FIFO pipes in the world-listable /tmp directory, the impact is significant. Local users on the same host can enumerate active sessions, while remote attackers can leverage predictable session IDs to hijack active terminal sessions.

How the Flaw Works

This vulnerability is a classic example of insufficient entropy and the misuse of non-cryptographic pseudorandom number generators (PRNGs). In general, when a system uses a predictable PRNG like the Mersenne Twister to generate security-sensitive tokens, an attacker who can observe a sufficient sample size of those tokens can mathematically reconstruct the internal state of the generator.

Once the internal state is compromised, the attacker can accurately predict future tokens and potentially derive past ones. Furthermore, relying on predictable naming conventions for temporary files in shared directories creates a race condition or information disclosure vector, allowing unauthorized parties to interact with files they should not have access to, often leading to privilege escalation or session interception.

How to Protect Your Systems

• Review your codebase for instances of random.randrange or similar functions being used for security-sensitive tokens and replace them with secrets module equivalents.
• Immediately audit and restrict permissions on the /tmp directory or the specific paths where application FIFOs are created to prevent unauthorized enumeration.
• Monitor system logs and network traffic for repeated, sequential requests to the X-Urwid-ID header, which may indicate an attacker attempting to map the PRNG state.
• Apply any available security patches provided by the Urwid maintainers as soon as they are released to remediate the insecure generation logic.
• Implement strict network-level access controls to ensure that the Urwid web interface is not exposed to untrusted environments or the public internet.

Given the critical severity of this flaw and the potential for full OS-level code execution, it is imperative that administrators address these issues immediately. The suppression of previous security warnings, such as the Bandit S311 alert, highlights the importance of addressing developer warnings rather than bypassing them, as such shortcuts often lead to the exact type of exploitable weakness seen here.