Insecure Randomness

Use of predictable pseudo-random generators for security decisions such as tokens and keys.

Specifications & Metrics

cwe

CWE-338

impact

High

Core Principles & Analysis

• Math.random-style generators are guessable from a few outputs.
• Session tokens and password-reset links fail hardest when their entropy is fake.
• Cryptographic RNGs exist precisely for these calls.