THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-9323 (HIGH 8.1) — The urwid web display backend (urwid/display/web.py) generates web session identifiers (urwid_id) in Screen.start() by concatenating two random.randrange(10**9) calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately

[NVD] CVE-2026-9323 (HIGH 8.1) — The urwid web display backend (urwid/display/web.py) generates web session identifiers (urwid_id) in Screen.start() by concatenating two random.randrange(10**9) calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately

lownvdPublished 2026-07-18

CVE-2026-9323 CVSS: 8.1 HIGH Published: 2026-07-18T14:17:12.170

The urwid web display backend (urwid/display/web.py) generates web session identifiers (urwid_id) in Screen.start() by concatenating two random.randrange(10**9) calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately 30 bits of PRNG state, and the Mersenne Twister interna

Indicators of compromise

CVE-2026-9323cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-9323