Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CWE-336 (PRNG中使用相同种子) — Vulnerability Class 2

2 vulnerabilities classified as CWE-336 (PRNG中使用相同种子). AI Chinese analysis included.

CWE-336 represents a critical algorithmic weakness where a Pseudo-Random Number Generator is initialized with a static, predictable seed value rather than a dynamic one. Because PRNGs are deterministic algorithms, reusing the same seed guarantees identical sequences of output numbers across different executions or sessions. Attackers typically exploit this flaw by observing initial outputs or knowing the fixed seed to predict subsequent values, effectively breaking the security model of systems relying on randomness for session tokens, cryptographic keys, or nonces. To prevent this vulnerability, developers must ensure that the PRNG is seeded with high-entropy data derived from a cryptographically secure random source, such as operating system entropy pools, for every initialization. This approach ensures that each generated sequence is unique and computationally infeasible for an adversary to guess, thereby maintaining the integrity and unpredictability required for secure application operations.

MITRE CWE Description
A Pseudo-Random Number Generator (PRNG) uses the same seed each time the product is initialized. Given the deterministic nature of PRNGs, using the same seed for each initialization will lead to the same output in the same order. If an attacker can guess (or knows) the seed, then the attacker may be able to determine the random numbers that will be produced from the PRNG.
Common Consequences (1)
Other, Access ControlOther, Bypass Protection Mechanism
Mitigations (2)
Architecture and DesignDo not reuse PRNG seeds. Consider a PRNG that periodically re-seeds itself as needed from a high quality pseudo-random output, such as hardware devices.
Architecture and Design, RequirementsUse products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems, or use the more recent FIPS 140-3 [REF-1192] if possible.
Examples (2)
The following code uses a statistical PRNG to generate account IDs.
private static final long SEED = 1234567890; public int generateAccountID() { Random random = new Random(SEED); return random.nextInt(); }
Bad · Java
This code attempts to generate a unique random identifier for a user's session.
function generateSessionID($userID){ srand($userID); return rand(); }
Bad · PHP
CVE IDTitleCVSSSeverityPublished
CVE-2026-24044 ESS Community Helm Chart has a weak server key generation method — ess-helm 9.1AICriticalAI2026-02-12
CVE-2021-42810 Safenet Authentication Service Remote Desktop Gateway prior to 2.0.3 may allow privilege escilation to authenticated users — SafeNet Authentication Service 7.8 High2022-01-19

Vulnerabilities classified as CWE-336 (PRNG中使用相同种子) represent 2 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.