CWE-338
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Monthly
PictShare versions before 3.7.1 generate the per-file delete_code authorization token using PHP's non-cryptographic rand() PRNG, allowing an attacker who knows a hosted file's hash to predict or infer valid delete codes and delete other users' uploads without authorization. The vulnerability is remotely reachable and requires no authentication or user interaction (CVSS:4.0 AV:N/PR:N/UI:N), but exploitation is constrained by HIGH attack complexity (AC:H) because the attacker must reconstruct the PRNG state; the resulting impact is availability-only (VA:H) and grants no data disclosure. No public exploit code was identified at time of analysis and there is no CISA KEV listing; vendor-released patch: 3.7.1.
Administrator account takeover in GetSimple CMS CE 3.3.22 is achievable because the password reset endpoint is reachable without authentication and, on a reset request for an existing user, immediately writes a hash of a newly generated temporary password that was produced by PHP rand() seeded with microtime(). The time-bounded seed leaves a limited effective candidate space, and because the admin login endpoint enforces neither rate limiting nor account lockout (independent assessment: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), an unauthenticated remote attacker who knows or enumerates a valid username can generate candidate passwords and test them online until the correct one is found. Exploitation hinges on predicting or narrowing the PRNG value for the reset moment and sustaining enough login attempts, and it is self-defeating in stealth terms because submitting the reset silently overwrites the legitimate administrator's password; no public exploit code was identified at time of analysis and no vendor-released patch exists, though this is a genuine high-priority issue despite the absence of exploitation telemetry.
Predictable Active Directory service-account password generation in Fortra BoKS Manager's boks_keytabmd daemon allows an attacker who knows the target service principal and can approximate the password-change timestamp to regenerate the seed, reconstruct the limited candidate set, and verify guesses offline against a captured Kerberos ticket or authentication endpoint. Only deployments that use BoKS keytab management to automate AD service-account credentials on boks-server versions before 9.0.0.6 are exposed, which makes exploitation targeted rather than opportunistic. No public exploit code or confirmed in-the-wild exploitation is identified at time of analysis (no CISA KEV listing, SSVC exploitation value 'none'), but the assessed impact is total for affected credential material, making mandatory post-patch rotation of every generated service-account password essential.
Predictable, non-cryptographic credential generation in Postiz (gitroomhq/postiz-app, all versions prior to v2.24.0) allows unauthenticated remote attackers to reconstruct the V8 xorshift128+ PRNG state and derive OAuth access tokens, authorization codes, client secrets, organization API keys and PKCE verifiers issued to other users and organizations. Practical exploitation is limited by the requirement that the unauthenticated OAuth dynamic client registration endpoint be enabled and network-reachable, since that endpoint is what returns freshly generated client credentials supplying the consecutive PRNG output needed to solve for internal state; concurrent credential generation by other users interleaves draws and degrades recoverability, which is why the assessed vector carries high attack complexity. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but successful exploitation yields high confidentiality and integrity impact across tenants, and a vendor patch is available in v2.24.0 (advisory PSA-2026-TD98KY).
Administrative account takeover in NivoCart through 2.4.0 is possible because the forgotten.php password-reset flow derives recovery codes from PHP's non-cryptographic mt_rand() and MD5, allowing unauthenticated remote attackers who know a valid administrator email address to predict or brute-force the 10-hex-character token and reset the administrator password. No authentication or user interaction is required per the assessed vectors (PR:N/UI:N), and the absence of rate limiting and token expiration materially lowers the effort; CVE metadata scores this 9.2 under CVSS 4.0 and the independent assessment confirms high severity. No public exploit identified at time of analysis, but the vulnerable code path and affected version are publicly documented.
Unauthenticated attackers can reset the password of any Cotonti account, including administrator accounts, because password-recovery validation tokens in Cotonti through 1.0.0 are derived from md5(microtime()) rather than a cryptographically secure random source, leaving roughly one million predictable candidate values per second. Exploitation requires the attacker to trigger the recovery flow for a target account, read the server's Date header to bootstrap the microtime() timing window, then precompute and probe candidate tokens against the passrecover endpoint before the seed drifts - a timing-constrained but fully unauthenticated attack (assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:H; CVSS 4.0 base 9.2). No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; any endpoint rate-limiting or short token lifetime further constrains the probing step, so this is a genuine high-priority flaw rather than a CVSS-inflation case.
Unauthenticated remote attackers can forge valid administrator session cookies for the Chaitin SafeLine management console (all versions through 9.4.1) because the session-signing secret is derived from a time-seeded math/rand generator (CWE-338) and can be reconstructed offline once the install timestamp is bounded. Successful exploitation yields full administrative control of the protected sites managed by that console, matching the 9.2 CVSS 4.0 rating and the independently assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H profile. Two prerequisites limit practical reach: the management console must be network-reachable from the attacker, and the attacker must be able to narrow the installation time enough to make the seed search feasible. No public exploit code and no confirmed in-the-wild exploitation were identified at the time of analysis, and consoles placed behind network segmentation, VPN, or IP allow-listing are not exposed to remote cookie forgery.
Cryptographically weak PRNG use in openssl_encrypt before 1.4.0 exposes steganographic pixel selection to full state-recovery attacks. The library's steganography module seeds Python's Mersenne Twister with only 64 bits of SHA-256 hash material derived from the user password, then uses it to select pixel positions for hidden data - a design flaw captured by CWE-338. Any attacker who knows or can brute-force the steganography password can deterministically reconstruct the PRNG sequence and enumerate every pixel carrying concealed data, breaking steganographic confidentiality entirely. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the MT state-recovery technique is well-documented and requires no novel research.
Predictable SM2 private-key and signing-nonce generation in the sm-crypto npm library (versions prior to 0.5.0) lets an attacker recover keys generated in Node.js. Because jsbn's SecureRandom checks window.crypto rather than Node's globalThis.crypto, the default sm2.generateKeyPairHex() falls back to seeding an ARC4 stream from Math.random() and the wall clock, so an adversary who observes a few Math.random() outputs and estimates the generation time can reconstruct private keys and forge signatures. Publicly available exploit code exists (reproduced end-to-end against the real npm packages), but no public exploit is identified as being used in active attacks and there is no CISA KEV listing.
Credential derivation in Red Hat OpenShift AI's Data Science Pipelines Operator allows unauthenticated remote attackers to predict MariaDB root/user passwords and MinIO access/secret keys by exploiting a cryptographically weak PRNG (CWE-338). Any attacker who can reach the MinIO Route or MariaDB Service over the network can compute valid credentials without prior authentication, then access all pipeline artifacts and metadata stored in the system. No active exploitation is confirmed and no public exploit code has been identified at time of analysis, but the CVSS 7.5 High rating with AV:N and PR:N reflects a no-authentication-barrier condition against exposed services.
PictShare versions before 3.7.1 generate the per-file delete_code authorization token using PHP's non-cryptographic rand() PRNG, allowing an attacker who knows a hosted file's hash to predict or infer valid delete codes and delete other users' uploads without authorization. The vulnerability is remotely reachable and requires no authentication or user interaction (CVSS:4.0 AV:N/PR:N/UI:N), but exploitation is constrained by HIGH attack complexity (AC:H) because the attacker must reconstruct the PRNG state; the resulting impact is availability-only (VA:H) and grants no data disclosure. No public exploit code was identified at time of analysis and there is no CISA KEV listing; vendor-released patch: 3.7.1.
Administrator account takeover in GetSimple CMS CE 3.3.22 is achievable because the password reset endpoint is reachable without authentication and, on a reset request for an existing user, immediately writes a hash of a newly generated temporary password that was produced by PHP rand() seeded with microtime(). The time-bounded seed leaves a limited effective candidate space, and because the admin login endpoint enforces neither rate limiting nor account lockout (independent assessment: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), an unauthenticated remote attacker who knows or enumerates a valid username can generate candidate passwords and test them online until the correct one is found. Exploitation hinges on predicting or narrowing the PRNG value for the reset moment and sustaining enough login attempts, and it is self-defeating in stealth terms because submitting the reset silently overwrites the legitimate administrator's password; no public exploit code was identified at time of analysis and no vendor-released patch exists, though this is a genuine high-priority issue despite the absence of exploitation telemetry.
Predictable Active Directory service-account password generation in Fortra BoKS Manager's boks_keytabmd daemon allows an attacker who knows the target service principal and can approximate the password-change timestamp to regenerate the seed, reconstruct the limited candidate set, and verify guesses offline against a captured Kerberos ticket or authentication endpoint. Only deployments that use BoKS keytab management to automate AD service-account credentials on boks-server versions before 9.0.0.6 are exposed, which makes exploitation targeted rather than opportunistic. No public exploit code or confirmed in-the-wild exploitation is identified at time of analysis (no CISA KEV listing, SSVC exploitation value 'none'), but the assessed impact is total for affected credential material, making mandatory post-patch rotation of every generated service-account password essential.
Predictable, non-cryptographic credential generation in Postiz (gitroomhq/postiz-app, all versions prior to v2.24.0) allows unauthenticated remote attackers to reconstruct the V8 xorshift128+ PRNG state and derive OAuth access tokens, authorization codes, client secrets, organization API keys and PKCE verifiers issued to other users and organizations. Practical exploitation is limited by the requirement that the unauthenticated OAuth dynamic client registration endpoint be enabled and network-reachable, since that endpoint is what returns freshly generated client credentials supplying the consecutive PRNG output needed to solve for internal state; concurrent credential generation by other users interleaves draws and degrades recoverability, which is why the assessed vector carries high attack complexity. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but successful exploitation yields high confidentiality and integrity impact across tenants, and a vendor patch is available in v2.24.0 (advisory PSA-2026-TD98KY).
Administrative account takeover in NivoCart through 2.4.0 is possible because the forgotten.php password-reset flow derives recovery codes from PHP's non-cryptographic mt_rand() and MD5, allowing unauthenticated remote attackers who know a valid administrator email address to predict or brute-force the 10-hex-character token and reset the administrator password. No authentication or user interaction is required per the assessed vectors (PR:N/UI:N), and the absence of rate limiting and token expiration materially lowers the effort; CVE metadata scores this 9.2 under CVSS 4.0 and the independent assessment confirms high severity. No public exploit identified at time of analysis, but the vulnerable code path and affected version are publicly documented.
Unauthenticated attackers can reset the password of any Cotonti account, including administrator accounts, because password-recovery validation tokens in Cotonti through 1.0.0 are derived from md5(microtime()) rather than a cryptographically secure random source, leaving roughly one million predictable candidate values per second. Exploitation requires the attacker to trigger the recovery flow for a target account, read the server's Date header to bootstrap the microtime() timing window, then precompute and probe candidate tokens against the passrecover endpoint before the seed drifts - a timing-constrained but fully unauthenticated attack (assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:H; CVSS 4.0 base 9.2). No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; any endpoint rate-limiting or short token lifetime further constrains the probing step, so this is a genuine high-priority flaw rather than a CVSS-inflation case.
Unauthenticated remote attackers can forge valid administrator session cookies for the Chaitin SafeLine management console (all versions through 9.4.1) because the session-signing secret is derived from a time-seeded math/rand generator (CWE-338) and can be reconstructed offline once the install timestamp is bounded. Successful exploitation yields full administrative control of the protected sites managed by that console, matching the 9.2 CVSS 4.0 rating and the independently assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H profile. Two prerequisites limit practical reach: the management console must be network-reachable from the attacker, and the attacker must be able to narrow the installation time enough to make the seed search feasible. No public exploit code and no confirmed in-the-wild exploitation were identified at the time of analysis, and consoles placed behind network segmentation, VPN, or IP allow-listing are not exposed to remote cookie forgery.
Cryptographically weak PRNG use in openssl_encrypt before 1.4.0 exposes steganographic pixel selection to full state-recovery attacks. The library's steganography module seeds Python's Mersenne Twister with only 64 bits of SHA-256 hash material derived from the user password, then uses it to select pixel positions for hidden data - a design flaw captured by CWE-338. Any attacker who knows or can brute-force the steganography password can deterministically reconstruct the PRNG sequence and enumerate every pixel carrying concealed data, breaking steganographic confidentiality entirely. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the MT state-recovery technique is well-documented and requires no novel research.
Predictable SM2 private-key and signing-nonce generation in the sm-crypto npm library (versions prior to 0.5.0) lets an attacker recover keys generated in Node.js. Because jsbn's SecureRandom checks window.crypto rather than Node's globalThis.crypto, the default sm2.generateKeyPairHex() falls back to seeding an ARC4 stream from Math.random() and the wall clock, so an adversary who observes a few Math.random() outputs and estimates the generation time can reconstruct private keys and forge signatures. Publicly available exploit code exists (reproduced end-to-end against the real npm packages), but no public exploit is identified as being used in active attacks and there is no CISA KEV listing.
Credential derivation in Red Hat OpenShift AI's Data Science Pipelines Operator allows unauthenticated remote attackers to predict MariaDB root/user passwords and MinIO access/secret keys by exploiting a cryptographically weak PRNG (CWE-338). Any attacker who can reach the MinIO Route or MariaDB Service over the network can compute valid credentials without prior authentication, then access all pipeline artifacts and metadata stored in the system. No active exploitation is confirmed and no public exploit code has been identified at time of analysis, but the CVSS 7.5 High rating with AV:N and PR:N reflects a no-authentication-barrier condition against exposed services.