Medium severityJavaCryptographyMEDIUM confidence

Insecure Random

java.util.Random / Math.random are statistically predictable and must not generate security-sensitive values such as tokens, session IDs, password reset codes, nonces, or salts (CWE-330/CWE-338).

Standards mapping

CWE: CWE-330: Use of Insufficiently Random Values CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
OWASP Top 10: A02:2021 - Cryptographic Failures
OWASP ASVS: V6.3.1 (L2)

Vulnerable vs. safe

Flagged by this check

Random r = new Random();

Passes - the safe pattern

SecureRandom sr = new SecureRandom();

Why it matters & how to fix it

java.util.Random / Math.random are statistically predictable and must not generate security-sensitive values such as tokens, session IDs, password reset codes, nonces, or salts (CWE-330/CWE-338). Use java.security.SecureRandom (and RandomStringUtils.random(len, 0, 0, ..., secureRandom) if you need string tokens).

References

https://cwe.mitre.org/data/definitions/338.html

Rule ID integsec-java-insecure-random - engine: Opengrep - license: MIT - Copyright (c) IntegSec Inc.

TurboPentest runs this check automatically

Connect a GitHub repo and this check runs on every white-box pentest - AI-validated and reported with proof, from $99 per target.

Start a pentest

Related checks