Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CWE-330 (使用不充分的随机数) — Vulnerability Class 125

125 vulnerabilities classified as CWE-330 (使用不充分的随机数). AI Chinese analysis included.

CWE-330 represents a critical weakness where software relies on predictable or insufficiently random values within security-sensitive contexts, such as session token generation or cryptographic key creation. Attackers typically exploit this flaw by analyzing patterns in the generated values to predict future outputs, thereby bypassing authentication mechanisms or hijacking active user sessions. This vulnerability often stems from the misuse of standard pseudo-random number generators that lack cryptographic security properties. To mitigate this risk, developers must employ cryptographically secure pseudo-random number generators (CSPRNGs) that are specifically designed to resist prediction even if previous outputs are known. Additionally, ensuring proper seeding with high-entropy sources and avoiding custom randomization algorithms are essential practices for maintaining the integrity of security-dependent operations.

MITRE CWE Description
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
Common Consequences (3)
Confidentiality, OtherOther
When a protection mechanism relies on random values to restrict access to a sensitive resource, such as a session ID or a seed for generating a cryptographic key, then the resource being protected could be accessed by guessing the ID or key.
Access Control, OtherBypass Protection Mechanism, Other
If product relies on unique, unguessable IDs to identify a resource, an attacker might be able to guess an ID for a resource that is owned by another user. The attacker could then read the resource, or pre-create a resource with the same ID to prevent the legitimate program from properly sending the…
Access ControlBypass Protection Mechanism, Gain Privileges or Assume Identity
When an authorization or authentication mechanism relies on random values to restrict access to restricted functionality, such as a session ID or a seed for generating a cryptographic key, then an attacker may access the restricted functionality by guessing the ID or key.
Mitigations (3)
Architecture and DesignUse a well-vetted algorithm that is currently considered to be strong by experts in the field, and select well-tested implementations with adequate length seeds. In general, if a pseudo-random number generator is not advertised as being cryptographically secure, then it is probably a statistical PRNG and should not be used in security-sensitive contexts. Pseudo-random number generators can produce…
ImplementationConsider a PRNG that re-seeds itself as needed from high quality pseudo-random output sources, such as hardware devices.
Architecture and Design, RequirementsUse products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").
Examples (2)
This code attempts to generate a unique random identifier for a user's session.
function generateSessionID($userID){ srand($userID); return rand(); }
Bad · PHP
The following code uses a statistical PRNG to create a URL for a receipt that remains active for some period of time after a purchase.
String GenerateReceiptURL(String baseUrl) { Random ranGen = new Random(); ranGen.setSeed((new Date()).getTime()); return(baseUrl + ranGen.nextInt(400000000) + ".html"); }
Bad · Java
CVE IDTitleCVSSSeverityPublished
CVE-2026-18531 IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak HMAC Session Secret — Maximo Application Suite 5.3 Medium2026-08-05
CVE-2026-71225 Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries — libkcapi 6.5 Medium2026-08-05
CVE-2026-66391 Apache Wicket: leaked and missing CSP headers — Apache Wicket--2026-07-27
CVE-2026-46351 BigBlueButton: Insecure Randomness allows to guess user's conference session token and impersonate them — bigbluebutton 8.1 High2026-07-16
CVE-2026-47703 AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle — AdGuardHome--2026-07-15
CVE-2026-14702 zcaceres markdownify-mcp webpage-to-markdown Markdownify.ts saveToTempFile random values — markdownify-mcp 2.5 Low2026-07-05
CVE-2026-14570 Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random generator, leading to private-key recovery — Crypt::DSA--2026-07-05
CVE-2026-45673 Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port — netty 6.8 Medium2026-06-12
CVE-2026-41701 In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues — Spring AMQP 4.4 Medium2026-06-09
CVE-2026-41838 Spring Framework Predictable Session ID in WebSocket Module — Spring Framework 4.8 Medium2026-06-09
CVE-2026-41207 netty-incubator-codec-ohttp's HPKEContext operations may produce empty byte[] on failures — netty-incubator-codec-ohttp--2026-06-04
CVE-2026-50208 Permissive TrustAllCerts TLS Verification — Connect M6E 5G Portable WiFi Router--2026-06-04
CVE-2026-44054 Predictable afpd session token — Netatalk 6.5 Medium2026-05-21
CVE-2026-42155 Magento LTS: Weak API Session ID — Predictable MD5 of Time-Derived Inputs — magento-lts--2026-05-15
CVE-2026-7847 chatchat-space Langchain-Chatchat Uploaded File openai_routes.py _get_file_id random values — Langchain-Chatchat 2.6 Low2026-05-05
CVE-2026-40975 VMware Spring Boot 安全特征问题漏洞 — Spring Boot 4.8 Medium2026-04-27
CVE-2026-40496 FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force — freescout 8.2AIHighAI2026-04-21
CVE-2026-40306 DNN has same HostGUID for all new installs — Dnn.Platform 5.4AIMediumAI2026-04-17
CVE-2026-33710 Chamilo LMS has Weak REST API Key Generation (Predictable) — chamilo-lms 7.5 High2026-04-10
CVE-2026-34511 OpenClaw < 2026.4.2 - PKCE Verifier Exposure via OAuth State Parameter — OpenClaw 5.3 Medium2026-04-03
CVE-2026-25072 XikeStor SKS8310-8X Predictable Session Identifiers — XikeStor SKS8310-8X 9.1 -2026-03-07
CVE-2026-20101 Cisco Secure Firewall Adaptive Security Appliance和Cisco Secure FTD Software 安全特征问题漏洞 — Cisco Secure Firewall Adaptive Security Appliance (ASA) Software 8.6 High2026-03-04
CVE-2026-27755 SODOLA SL902-SWTGW124AS <= 200.1.20 Predictable Session ID — SODOLA SL902-SWTGW124AS 9.8 Critical2026-02-27
CVE-2026-23999 Fleet: Device lock PIN can be predicted if lock time is known — fleet 5.7AIMediumAI2026-02-26
CVE-2026-27637 FreeScout's Predictable Authentication Token Enables Account Takeover — freescout 9.8 Critical2026-02-25
CVE-2024-48928 Piwigo's secret key can be brute forced — Piwigo 7.5 -2026-02-24
CVE-2026-27515 Binardat 10G08-0800GSM Network Switch Predictable Session Identifiers — 10G08-0800GSM Network Switch 9.1 Critical2026-02-24
CVE-2026-2966 Cesanta Mongoose DNS Transaction ID dns.c mg_sendnsreq random values — Mongoose 3.7 Low2026-02-23
CVE-2025-15574 Insecure Credential Generation for Solax Power Pocket WiFi models MQTT Cloud Connection — Pocket WiFi 3.0 9.8AICriticalAI2026-02-12
CVE-2025-64097 NervesHub has Insufficient Token Entropy that Allows Authentication Bypass via Brute Force — nerves_hub_web 8.1AIHighAI2026-01-22

Vulnerabilities classified as CWE-330 (使用不充分的随机数) represent 125 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.