OpenVPN Access Server prior to 2.11 uses a weak random generator used to create user session token for the web portal
openvpn openvpn access server