AIKIDO-2026-890544

TL;DR

The web display backend in urwid/display/web.py generates web session identifiers in Screen.start() by concatenating two random.randrange values drawn from Python's non-cryptographic Mersenne Twister PRNG. The identifier is exposed through the X-Urwid-ID response header and is also used as the name of a FIFO created in the world-listable /tmp directory, so an attacker who observes enough identifiers can reconstruct the PRNG state and predict session tokens, while a local user can enumerate active tokens directly. With a valid session identifier an attacker can read the victim's terminal output, inject keystrokes into the session, and disrupt or crash it. The fix replaces the predictable identifier with a cryptographically secure random value.