CWEweakness

CWE-340 Generation of Predictable Numbers or Identifiers

Official page ↗
Abstraction
Class
Structure
Simple
Status
Incomplete
Languages
Not Language-Specific
CWE version
5.0

Description

The product uses a scheme that generates numbers or identifiers that are more predictable than required.

Common consequences

• Other: Varies by Context

Detection methods

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Observed examples

• CVE-2022-29330: Product for administering PBX systems uses predictable identifiers and timestamps for filenames (CWE-340) which allows attackers to access files via direct request (CWE-425). • CVE-2001-1141: PRNG allows attackers to use the output of small PRNG requests to determine the internal state information, which could be used by attackers to predict future pseudo-random numbers. • CVE-1999-0074: Listening TCP ports are sequentially allocated, allowing spoofing attacks.

Related

Observed example · CVE (3)

  • CVE-2022-29330 Missing access control in the backup system of Telesoft VitalPBX before 3.2.1 allows attackers to access the PJSIP and SIP extension… vulnerability
  • CVE-2001-1141 The Pseudo-Random Number Generator (PRNG) in SSLeay and OpenSSL before 0.9.6b allows attackers to use the output of small PRNG requests to… vulnerability
  • CVE-1999-0074 Listening TCP ports are sequentially allocated, allowing spoofing attacks. vulnerability

Can precede · CWE (1)

  • CWE-384 Session Fixation weakness

Child of · CWE (1)

  • CWE-330 Use of Insufficiently Random Values weakness

Referenced by CVE · weakness (60)

  • CVE-2026-85297 Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to intercept and access… vulnerability
  • CVE-2026-46346 The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. vulnerability
  • CVE-2026-46347 The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. vulnerability
  • CVE-2026-79980 The DHCPv4 client in subsys/net/lib/dhcpv4/dhcpv4.c maintained its transaction identifier (iface->config.dhcpv4.xid) as a counter rather… vulnerability
  • CVE-2026-85496 The Botslab G980H dash camera firmware generates session identifiers using a small sequential value space rather than a suitably… vulnerability
  • CVE-2026-95653 Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values,… vulnerability
  • CVE-2025-14602 The application generates uploaded file names using a weak and predictable method based on the request timestamp. vulnerability
  • CVE-2026-64964 ATutor generates predictable email confirmation tokens due to the use of insufficiently random values in the account confirmation… vulnerability
  • CVE-2026-75106 OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing… vulnerability
  • CVE-2026-13577 Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. vulnerability
  • CVE-2026-47085 An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. vulnerability
  • CVE-2026-56016 CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources. vulnerability
  • CVE-2026-9219 Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior have a predictable registration ID derived from IMEI. vulnerability
  • CVE-2026-11374 In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate… vulnerability
  • CVE-2026-9733 Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter. vulnerability
  • CVE-2026-9692 Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely. vulnerability
  • CVE-2026-42932 Naxclow device identifiers use fixed manufacturing prefixes combined with sequential counters, producing a fully predictable and enumerable… vulnerability
  • CVE-2026-45673 Netty is a network application framework for development of protocol servers and clients. vulnerability
  • CVE-2026-8503 Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids. vulnerability
  • CVE-2026-5084 WebDyne::Session versions before 3.003_704 for Perl generate the session id insecurely. vulnerability
  • CVE-2026-5081 Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure. vulnerability
  • CVE-2026-5080 Dancer::Session::Abstract versions through 1.3522 for Perl generates session ids insecurely. vulnerability
  • CVE-2026-40496 FreeScout is a free self-hosted help desk and shared mailbox. vulnerability
  • CVE-2026-5085 Solstice::Session versions through 1440 for Perl generates session ids insecurely. vulnerability
  • CVE-2026-5082 Amon2::Plugin::Web::CSRFDefender versions from 7.00 through 7.03 for Perl generate an insecure session id. vulnerability
  • CVE-2026-5083 Ado::Sessions versions through 0.935 for Perl generates insecure session ids. vulnerability
  • CVE-2025-13044 IBM Concert 1.0.0 through 2.2.0 creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a… vulnerability
  • CVE-2026-28810 Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning. vulnerability
  • CVE-2025-15604 Amon2 versions before 6.17 for Perl use an insecure random_string implementation for security functions. vulnerability
  • CVE-2026-3256 HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids. vulnerability
Show all 60 ›

Referenced by CWE · child of (3)

  • CWE-341 Predictable from Observable State weakness
  • CWE-342 Predictable Exact Value from Previous Values weakness
  • CWE-343 Predictable Value Range from Previous Values weakness

Referenced by CWE · requires (1)

  • CWE-61 UNIX Symbolic Link (Symlink) Following weakness

Referenced by OWASP · mapped cwe (2)

  • A04:2025 Cryptographic Failures Top 10 2025
  • A02:2021 Cryptographic Failures Top 10 2021