The urwid web display backend (urwid/display/web.py) generates web session identifiers (urwid_id) in Screen.start() by concatenating two random.randrange(10**9) calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately 30 bits of PRNG state, and the Mersenne Twister internal state is approximately 19,937 bits, so an attacker who observes approximately 334 session IDs (for example via the X-Urwid-ID HTTP response header) can fully reconstruct the internal state and predict all past and future session IDs (Path B). The same identifier is also used as the filename of a FIFO created in the world-listable /tmp directory (for example /tmp/urwid375487765176907690.in), so any local user on the host can list /tmp to enumerate active session tokens directly (Path A). With a valid session ID, an attacker can read the victim's terminal screen via the polling endpoint, inject keystrokes into the victim's session (yielding OS-level code ex
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-9323 exploits a critical cryptographic weakness in the urwid web display backend's session identifier generation. The vulnerability stems from using Python's Mersenne Twister PRNG—designed for statistical simulation, not security—to generate session IDs by concatenating two random.randrange(10**9) calls. Because Mersenne Twister's 19,937-bit internal state can be fully reconstructed from approximately 334 observed session IDs (accessible via HTTP response headers like X-Urwid-ID), attackers can forge arbitrary session tokens and hijack user sessions. This affects any application using urwid's web display backend for session management, particularly web-based terminal interfaces and remote administration tools. The CVSS 8.1 score reflects the high impact of session hijacking, which enables unauthorized access, data theft, and lateral movement within affected systems.
While Casky.ai's current skill library (0 matching skills) doesn't directly address this specific CVE, practitioners using Claude AI with extended reasoning through Casky can detect exploitation patterns by analyzing authentication anomalies and session behavior. Organizations should focus on identifying suspicious patterns that would align with Session Hijacking (MITRE Technique T1539) and Valid Accounts abuse (T1078): monitor for impossible travel scenarios, multiple concurrent sessions from different IP ranges using predictable session ID sequences, and HTTP response header analysis for X-Urwid-ID patterns showing mathematical predictability. Security teams leveraging AI-assisted threat analysis should examine authentication logs for session IDs generated in rapid succession and correlate these with unauthorized administrative actions, data access anomalies, or privilege escalation attempts that would indicate successful session token prediction and reuse.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-9323. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation