CVE-2017-16028

5.3 mediumEPSS 1.3%

react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native. The oauth Random Token is generated using a non-cryptographically strong RNG (Math.random()).

Severity

CVSS 3.0

5.3 medium

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 1.3% chance of exploitation in the next 30 days; higher than 71% of CVEs (scores of 2026-10-31)
CWEs: CWE-338, CWE-330
Published: 2018-06-04
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

randomatic_project:randomatic

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-6g33-f262-xjp4	npm	randomatic	<3.0.0	3.0.0

References

https://github.com/tableflip/react-native-meteor-oauth/blob/a7eb738b74c469f5db20296b44b7cae4e2337435/src/meteor-oauth.js#L66
https://nodesecurity.io/advisories/157
https://github.com/tableflip/react-native-meteor-oauth/blob/a7eb738b74c469f5db20296b44b7cae4e2337435/src/meteor-oauth.js#L66
https://nodesecurity.io/advisories/157

Check your stack JSON