CWE-341 (从可观察状态的可预测) — Vulnerability Class 10

CWE-341 represents a design weakness where security-critical values, such as session tokens or cryptographic keys, are generated using predictable inputs observable by an attacker. This flaw typically enables attackers to guess or reconstruct sensitive identifiers by analyzing system states like timestamps, process IDs, or sequential counters, thereby bypassing authentication or hijacking active sessions. Developers mitigate this risk by implementing cryptographically secure random number generators that produce high-entropy outputs independent of observable system variables. Additionally, utilizing non-sequential, unpredictable identifiers and regularly rotating secrets ensures that even if partial state information is leaked, the resulting values remain computationally infeasible to predict, maintaining the integrity and confidentiality of the application’s security mechanisms.