cve.bz

CWE-1241: Use of Predictable Algorithm in Random Number Generator

Filter

The device uses an algorithm that is predictable and generates a pseudo-random number.

What the weakness is: CWE-1241 at MITRE. OWASP Top 10: A04:2025 Cryptographic Failures

Related attack patterns (CAPEC): 1
  • CAPEC-97 Cryptanalysis Likelihood: Low · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-1241, as MITRE names them. Credits.

Ask an AI about CWE-1241

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-1241: Use of Predictable Algorithm in Random Number Generator and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/1241.html and https://cve.bz/cve/cwe/1241?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.3CVE-2026-82191EPSS 0.4%

    Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - A crafted link to the paypal notify endpoint, if followed by a victim's browser (or an aut…

  2. 6.3CVE-2026-82190EPSS 0.3%

    Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Anyone who obtains the site's Joomla `secret` can compute a valid access token for *any* order on the site wit…

  3. 6.5CVE-2026-73576EPSS 0.3%

    In Zimbra Collaboration (ZCS) before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration. The zimbraDocumentEditingJwtSecret is generated using an insecure random number generator, resulting in ins…

  4. 7.1CVE-2026-57869EPSS 0.4%

    Broken object-level access controls and the use of a deterministic pattern during random ID generation in MicroRealEstate allows attackers to access documents uploaded by landlords or tenants without authorization. This issue affects Micr…

  5. 6.3CVE-2026-6420EPSS 0.1%

    A flaw was found in Keylime. An attacker with root access on an enrolled monitored machine, where the Keylime agent runs, can exploit a vulnerability in the Keylime verifier. The verifier uses a hardcoded challenge nonce for Trusted Platfo…

  6. 7.5CVE-2026-26018EPSS 1.2%

    CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a denial of service vulnerability exists in CoreDNS's loop detection plugin that allows an attacker to crash the DNS server by sending specially crafted DNS queries. The…

  7. 5.3CVE-2025-13079EPSS 0.4%

    The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.2. This is due to the plugin generating predictable unsubs…

  8. 4.0CVE-2025-32056EPSS 0.3%

    The anti-theft protection mechanism can be bypassed by attackers due to weak response generation algorithms for the head unit. It is possible to reveal all 32 corresponding responses by sniffing CAN traffic or by pre-calculating the values…

  9. 8.1CVE-2023-4695EPSS 0.7%

    Use of Predictable Algorithm in Random Number Generator in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

  10. 5.3CVE-2021-3692EPSS 1.7%

    yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator

  11. 7.5CVE-2021-3689EPSS 1.9%

    yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator

  12. 7.5CVE-2016-10180EPSS 4.5%

    An issue was discovered on the D-Link DWR-932B router. WPS PIN generation is based on srand(time(0)) seeding.