Apache AppSamurai CVE-2026-19565

Exploitation requires the attacker to bound two observable values: the Unix epoch second in which the victim's session was created, and the process ID of the Apache mod_perl worker that handled the login. The creation second is often inferrable from the network-layer timestamp of the server's login response. The PID is constrained to the operating system's PID range and may be narrowed through timing attacks, predictable worker rotation patterns in a prefork MPM, or information disclosed in server headers or error pages. Critically, each candidate key must be validated through a live request to the server because the attacker lacks the server key required for offline verification; this online-oracle requirement limits automation (SSVC Automatable=no) and exposes the enumeration to server-side rate-limiting and intrusion detection. Sites that have configured the Keysource directive with externally supplied entropy are routed through an alternate code path in CreateSession and are not affected by this specific weakness. The attack requires no authentication, no network proximity, and no user interaction beyond the victim's normal login activity.

The NVD CVSS 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) accurately characterizes the real-world risk. The high attack complexity is warranted: an attacker must independently bound both the creation second of the target session and the PID of the handling worker, then conduct online enumeration where each candidate must be validated by a live server request - a process that exposes the attack to rate-limiting, IP blocking, and anomaly detection. EPSS at 0.28% (20th percentile) and SSVC Exploitation=none both confirm no current exploitation activity; these signals are mutually consistent with the attack's high operational complexity. The SSVC Automatable=no finding is significant - the requirement for an online oracle per candidate prevents mass or opportunistic exploitation. The C:L rating may appear conservative given that successful exploitation yields authentication bypass to protected resources, but the aggregate risk remains low because the attack is targeted, complex, and niche. No data conflicts or inconsistencies are present across the available sources.

An attacker monitors network traffic or application-layer signals to observe a target user's login response, bounding the session creation to a known Unix epoch second, and infers the Apache mod_perl worker PID through timing side-channels or server response headers. The attacker then iterates over approximately 10^6 microsecond values for the first Time::HiRes reading combined with candidate PIDs, constructing 64-character hex session cookies and submitting each in a crafted HTTP request to the protected application; when the server accepts a candidate, the attacker gains authenticated access as the victim without possessing valid credentials. No public proof-of-concept code has been identified, but the attack requires only standard HTTP tooling and arithmetic over a bounded key space.