Urwid Session Hijack Vulnerability Found

A severe security vulnerability has been identified within the urwid library, specifically affecting the web display backend component. The flaw involves how the system generates session identifiers, potentially allowing unauthorized parties to hijack active sessions and execute commands with the privileges of the victim.

Predictable Identifier Generation

The vulnerability, tracked as CVE-2026-9323, stems from the implementation of session ID generation within the Screen.start() function found in urwid/display/web.py. The backend produces session tokens by concatenating two results from Python's Mersenne Twister pseudorandom number generator (PRNG). Because this PRNG is not cryptographically secure, the session identifiers are inherently predictable.

State Reconstruction Vulnerability

An attacker capable of observing session identifiers, which are exposed via the X-Urwid-ID HTTP response header, can leverage this predictability to reconstruct the internal state of the generator. By gathering a sufficient volume of IDs, the attacker can then forecast both past and future session tokens. Furthermore, the library creates a FIFO file in the /tmp directory using the same session identifier, which remains world-listable. This allows local users on the host system to enumerate active session tokens directly by listing the directory contents.

Impact of Session Hijacking

Once an attacker obtains a valid session ID, the security of the host is compromised. The attacker can access the polling endpoint to read the victim's terminal screen or inject malicious keystrokes. In scenarios where the session is running a shell, this level of access can result in OS-level code execution under the identity of the session owner. Additionally, attackers can terminate or crash the session by injecting exit sequences or flooding the FIFO.

• Advisory ID: GHSA-83x9-8wvq-rrcp
• Severity: critical
• CVSS Score: 8.1
• Required observations for state reconstruction: approximately 334 session IDs
• Mersenne Twister internal state size: 19,937 bits

Security Oversight Details

The technical documentation notes that a prior Bandit S311 warning regarding the insecure use of the PRNG had been suppressed in the codebase. Rather than resolving the underlying cryptographic weakness, the implementation was bypassed with a # noqa: S311 comment, leaving the session generation logic vulnerable to exploitation.

Consequences for System Security

The discovery of this flaw suggests that any deployment utilizing the urwid web display backend may be subject to unauthorized session takeover. Because the issue involves both predictable PRNG output and insecure file handling in shared directory space, the implications extend to both remote observers and local users on the same machine. Developers and administrators relying on this library should examine their current implementations, as the existing design permits direct access to terminal sessions and underlying system privileges.