CWEweakness
CWE-1241 Use of Predictable Algorithm in Random Number Generator
- Abstraction
- Base
- Structure
- Simple
- Status
- Draft
- CWE version
- 5.0
Description
The device uses an algorithm that is predictable and generates a pseudo-random number.
Extended description
Pseudo-random number generator algorithms are predictable because their registers have a finite number of possible states, which eventually lead to repeating patterns. As a result, pseudo-random number generators (PRNGs) can compromise their randomness or expose their internal state to various attacks, such as reverse engineering or tampering.
Common consequences
• Confidentiality: Read Application Data
Potential mitigations
• [Architecture and Design, Implementation] It is highly recommended to use a true random number generator (TRNG) to ensure the security of encryption schemes. Hardware-based TRNGs generate unpredictable, unbiased, and independent random numbers because they employ physical phenomena, e.g., electrical noise, as sources to generate random numbers.
Observed examples
• CVE-2021-3692: PHP framework uses mt_rand() function (Marsenne Twister) when generating tokens
Related
Attack pattern · CAPEC (1)
- CAPEC-97 Cryptanalysis attack pattern
Observed example · CVE (1)
- CVE-2021-3692 yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator vulnerability
Child of · CWE (1)
- CWE-330 Use of Insufficiently Random Values weakness
Referenced by CAPEC · weakness (1)
- CAPEC-97 Cryptanalysis attack pattern
Referenced by CVE · weakness (12)
- CVE-2026-82190 Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Anyone who… vulnerability
- CVE-2026-82191 Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22,… vulnerability
- CVE-2026-73576 In Zimbra Collaboration (ZCS) before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration. vulnerability
- CVE-2026-57869 Broken object-level access controls and the use of a deterministic pattern during random ID generation in MicroRealEstate allows attackers… vulnerability
- CVE-2026-6420 A flaw was found in Keylime. vulnerability
- CVE-2026-26018 CoreDNS is a DNS server that chains plugins. vulnerability
- CVE-2025-13079 The Popup Builder – Create highly converting, mobile friendly marketing popups. vulnerability
- CVE-2025-32056 The anti-theft protection mechanism can be bypassed by attackers due to weak response generation algorithms for the head unit. vulnerability
- CVE-2023-4695 Use of Predictable Algorithm in Random Number Generator in GitHub repository pkp/pkp-lib prior to 3.3.0-16. vulnerability
- CVE-2021-3689 yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator vulnerability
- CVE-2021-3692 yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator vulnerability
- CVE-2016-10180 An issue was discovered on the D-Link DWR-932B router. vulnerability
Referenced by OWASP · mapped cwe (1)
- A04:2025 Cryptographic Failures Top 10 2025