Insecure Session ID Generation in Starch by Bluefeet

CVE-2025-40925

What is CVE-2025-40925?

The Starch product from Bluefeet has a significant vulnerability in the way it generates session IDs. Versions 0.14 and earlier utilize a default generator that combines several easily guessable parameters, including a SHA-1 hash, a counter, and the built-in rand function. The method used is unsuitable for cryptographic purposes, making session IDs predictable. This predictability could allow attackers to exploit the system by gaining unauthorized access, highlighting the importance of adopting secure session management practices. Users are encouraged to update to the latest version to mitigate the risk.

References