Pretty much immediately I found a bug in his session generation: https://github.com/davidmoreno/onion/blob/master/src/onion/sessions.c#L34-L55 https://github.c

Pretty much immediately I found a bug in his session generation: https://github.com/davidmoreno/onion/blob/master/src/onion/sessions.c#L34-L55 https://github.com/davidmoreno/onion/blob/master/src/onion/s... The fact that in amongst the doc comment is "not really safe" should probably be a big red flag. Then this happens: https://github.com/davidmoreno/onion/blob/master/src/onion/sessions.c#L65 https://github.com/davidmoreno/onion/blob/master/src/onion/s... Not to mention that here: https://github.com/davidmoreno/onion/blob/master/src/onion/handlers/auth_pam.c#L53-L54 https://github.com/davidmoreno/onion/blob/master/src/onion/h... It'll just let you in if you can guess someone else's session. Seriously. Systems ship with crypto API's. And uuid libraries. USE THEM, FFS.