Insecure Random

Vulnerable vs. safe

var otp = rng.Next(100000, 999999);

var token = RandomNumberGenerator.GetInt32(100000, 999999);

Why it matters & how to fix it

System.Random is a non-cryptographic PRNG; using it to generate security values (tokens, OTPs, nonces, salts, keys, session identifiers) yields predictable output (CWE-338). Use System.Security.Cryptography. RandomNumberGenerator (e.g. RandomNumberGenerator.GetBytes / GetInt32) for any security-sensitive randomness.

References

• https://cwe.mitre.org/data/definitions/338.html
• https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.randomnumbergenerator

Related checks

• JavaScript / TypeScript - Cryptography
  Insecure Randomness For Secrets
• JavaScript / TypeScript - Cryptography
  Weak Cipher Algorithm
• JavaScript / TypeScript - Cryptography
  Weak Hash Algorithm
• Python - Cryptography
  Insecure Random Token
• Python - Cryptography
  Weak Cipher DES ECB
• Python - Cryptography
  Weak Hash MD5 SHA1