GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Common Weakness Enumeration

CWE-331

Allowed

Insufficient Entropy

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

227 vulnerabilities reference this CWE, most recent first.

GHSA-QJXF-MC72-WJR2

Vulnerability from github – Published: 2024-09-17 21:31 – Updated: 2024-09-20 20:20
VLAI
Summary
Devise-Two-Factor Authentication Uses Insufficient Default OTP Shared Secret Length
Details

Summary

Under the default configuration, Devise-Two-Factor versions 1.0.0 or >= 4.0.0 & < 6.0.0 generate TOTP shared secrets that are 120 bits instead of the 128-bit minimum defined by RFC 4226. Using a shared secret shorter than the minimum to generate a multi-factor authentication code could make it easier for an attacker to guess the shared secret and generate valid TOTP codes.

Remediation

Devise-Two-Factor should be upgraded to version v6.0.0 as soon as possible. After upgrading, the length of shared secrets and TOTP URLs generated by the library will increase since the new shared secrets will be longer.

If upgrading is not possible, you can override the default otp_secret_length attribute in the model when configuring two_factor_authenticable and set it to a value of at least 26 to ensure newly generated shared secrets are at least 128-bits long.

After upgrading or implementing the workaround, applications using Devise-Two-Factor may wish to migrate users to the new OTP length to provide increased protection for those accounts. Turning off OTP for users by setting otp_required_for_login to false is not recommended since it would leave accounts unprotected. However, you may wish to implement application logic that checks the length of a user's shared secret and prompts users to re-enroll in OTP.

Background

Devise-Two-Factor uses ROTP to generate shared secrets for TOTP. In ROTP < 5.0.0, the first argument to the ROTP::Base32#random_base32 function represented the number of bytes to read from SecureRandom which were then returned as a base32-encoded string. In ROTP 5.1.0, this function was changed so that the first argument now represents the length of the base32-encoded string returned by the function instead of the number of bytes to read from SecureRandom resulting in a shorter key being generated for the same input value. (https://github.com/mdp/rotp/commit/15d5104e3cb99f97d36c772f8f09cf7e2e77de20).

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
6.0 (Medium)
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "devise-two-factor"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "6.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "devise-two-factor"
      },
      "versions": [
        "1.0.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2024-8796"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-331"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-09-17T21:31:50Z",
    "nvd_published_at": "2024-09-17T18:15:05Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nUnder the default configuration, Devise-Two-Factor versions 1.0.0 or \u003e= 4.0.0 \u0026 \u003c 6.0.0 generate TOTP shared secrets that are 120 bits instead of the 128-bit minimum defined by [RFC 4226](https://datatracker.ietf.org/doc/html/rfc4226). Using a shared secret shorter than the minimum to generate a multi-factor authentication code could make it easier for an attacker to guess the shared secret and generate valid TOTP codes.\n\n### Remediation\nDevise-Two-Factor should be upgraded to version v6.0.0 as soon as possible. After upgrading, the length of shared secrets and TOTP URLs generated by the library will increase since the new shared secrets will be longer.\n\nIf upgrading is not possible, you can override the default `otp_secret_length` attribute in the model when configuring `two_factor_authenticable` and set it to a value of at least 26 to ensure newly generated shared secrets are at least 128-bits long.\n\nAfter upgrading or implementing the workaround, applications using Devise-Two-Factor may wish to migrate users to the new OTP length to provide increased protection for those accounts. Turning off OTP for users by setting `otp_required_for_login` to false is not recommended since it would leave accounts unprotected. However, you may wish to implement application logic that checks the length of a user\u0027s shared secret and prompts users to re-enroll in OTP.\n\n### Background\nDevise-Two-Factor uses [ROTP](https://github.com/mdp/rotp) to generate shared secrets for TOTP. In ROTP \u003c 5.0.0, the first argument to the `ROTP::Base32#random_base32` function represented the number of bytes to read from SecureRandom which were then returned as a base32-encoded string. In ROTP 5.1.0, this function was changed so that the first argument now represents the length of the base32-encoded string returned by the function instead of the number of bytes to read from SecureRandom resulting in a shorter key being generated for the same input value. (https://github.com/mdp/rotp/commit/15d5104e3cb99f97d36c772f8f09cf7e2e77de20).",
  "id": "GHSA-qjxf-mc72-wjr2",
  "modified": "2024-09-20T20:20:41Z",
  "published": "2024-09-17T21:31:50Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/devise-two-factor/devise-two-factor/security/advisories/GHSA-qjxf-mc72-wjr2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8796"
    },
    {
      "type": "WEB",
      "url": "https://github.com/devise-two-factor/devise-two-factor/commit/cc6f34423d9c6af9f3e02be478c3c40dc7462e19"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/devise-two-factor/devise-two-factor"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Devise-Two-Factor Authentication Uses Insufficient Default OTP Shared Secret Length"
}

GHSA-QRGC-H67X-RJ3X

Vulnerability from github – Published: 2022-05-13 01:53 – Updated: 2022-05-13 01:53
VLAI
Details

A security feature bypass vulnerability exists when Windows Hyper-V BIOS loader fails to provide a high-entropy source, aka "Windows Hyper-V Security Feature Bypass Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.

Severity
4.2 (Medium)
CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2018-8435"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-331"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-09-13T00:29:00Z",
    "severity": "MODERATE"
  },
  "details": "A security feature bypass vulnerability exists when Windows Hyper-V BIOS loader fails to provide a high-entropy source, aka \"Windows Hyper-V Security Feature Bypass Vulnerability.\" This affects Windows Server 2016, Windows 10, Windows 10 Servers.",
  "id": "GHSA-qrgc-h67x-rj3x",
  "modified": "2022-05-13T01:53:42Z",
  "published": "2022-05-13T01:53:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8435"
    },
    {
      "type": "WEB",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8435"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/105240"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1041624"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-R2Q3-HJC8-7X6Q

Vulnerability from github – Published: 2026-05-16 00:31 – Updated: 2026-05-16 03:31
VLAI
Details

Crypt::DSA versions before 1.20 for Perl generate seeds using rand.

Seeds were generated using Perl's built-in rand function, which is predictable and unsuitable for security usage.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-8700"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-331"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-15T22:16:57Z",
    "severity": null
  },
  "details": "Crypt::DSA versions before 1.20 for Perl generate seeds using rand.\n\nSeeds were generated using Perl\u0027s built-in rand function, which is predictable and unsuitable for security usage.",
  "id": "GHSA-r2q3-hjc8-7x6q",
  "modified": "2026-05-16T03:31:27Z",
  "published": "2026-05-16T00:31:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8700"
    },
    {
      "type": "WEB",
      "url": "https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.20/changes"
    },
    {
      "type": "WEB",
      "url": "https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.20/diff/TIMLEGGE/Crypt-DSA-1.19#lib/Crypt/DSA/KeyChain.pm"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/05/15/26"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-R3V4-HRWM-CXM5

Vulnerability from github – Published: 2025-12-05 06:31 – Updated: 2025-12-05 06:31
VLAI
Details

The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force attacks. This affects KDE Connect before 1.33.0 on Android, KDE Connect before 25.04 on desktop, KDE Connect before 0.5 on iOS, Valent before 1.0.0.alpha.47, and GSConnect before 59.

Severity
4.7 (Medium)
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-32898"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-331"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-05T05:16:58Z",
    "severity": "MODERATE"
  },
  "details": "The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force attacks. This affects KDE Connect before 1.33.0 on Android, KDE Connect before 25.04 on desktop, KDE Connect before 0.5 on iOS, Valent before 1.0.0.alpha.47, and GSConnect before 59.",
  "id": "GHSA-r3v4-hrwm-cxm5",
  "modified": "2025-12-05T06:31:30Z",
  "published": "2025-12-05T06:31:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32898"
    },
    {
      "type": "WEB",
      "url": "https://kde.org/info/security/advisory-20250418-3.txt"
    },
    {
      "type": "WEB",
      "url": "https://kdeconnect.kde.org"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-R5R9-27M2-2JG7

Vulnerability from github – Published: 2022-05-03 03:19 – Updated: 2022-05-03 03:19
VLAI
Details

The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction IDs and source ports, aka "DNS Insufficient Socket Entropy Vulnerability" or "the Kaminsky bug."

Severity
6.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2008-1447"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-331"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2008-07-08T23:41:00Z",
    "severity": "MODERATE"
  },
  "details": "The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction IDs and source ports, aka \"DNS Insufficient Socket Entropy Vulnerability\" or \"the Kaminsky bug.\"",
  "id": "GHSA-r5r9-27m2-2jg7",
  "modified": "2022-05-03T03:19:14Z",
  "published": "2022-05-03T03:19:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-1447"
    },
    {
      "type": "WEB",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-037"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43334"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43637"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12117"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5725"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5761"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5917"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9627"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/6122"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/6123"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/6130"
    },
    {
      "type": "WEB",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00402.html"
    },
    {
      "type": "WEB",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00458.html"
    },
    {
      "type": "WEB",
      "url": "http://blog.invisibledenizen.org/2008/07/kaminskys-dns-issue-accidentally-leaked.html"
    },
    {
      "type": "WEB",
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494401"
    },
    {
      "type": "WEB",
      "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01523520"
    },
    {
      "type": "WEB",
      "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01662368"
    },
    {
      "type": "WEB",
      "url": "http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.apple.com/archives/security-announce//2008/Sep/msg00003.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.apple.com/archives/security-announce//2008/Sep/msg00004.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/064118.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00003.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=121630706004256\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=121866517322103\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=123324863916385\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=141879471518471\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2008-0533.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/30925"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/30973"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/30977"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/30979"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/30980"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/30988"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/30989"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/30998"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31011"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31012"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31014"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31019"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31022"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31030"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31031"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31033"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31052"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31065"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31072"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31093"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31094"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31137"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31143"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31151"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31152"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31153"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31169"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31197"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31199"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31204"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31207"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31209"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31212"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31213"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31221"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31236"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31237"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31254"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31326"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31354"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31422"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31430"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31451"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31482"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31495"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31588"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31687"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31823"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31882"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31900"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/33178"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/33714"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/33786"
    },
    {
      "type": "WEB",
      "url": "http://security.freebsd.org/advisories/FreeBSD-SA-08:06.bind.asc"
    },
    {
      "type": "WEB",
      "url": "http://security.gentoo.org/glsa/glsa-200807-08.xml"
    },
    {
      "type": "WEB",
      "url": "http://security.gentoo.org/glsa/glsa-200812-17.xml"
    },
    {
      "type": "WEB",
      "url": "http://security.gentoo.org/glsa/glsa-201209-25.xml"
    },
    {
      "type": "WEB",
      "url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2008\u0026m=slackware-security.452680"
    },
    {
      "type": "WEB",
      "url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2008\u0026m=slackware-security.539239"
    },
    {
      "type": "WEB",
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-239392-1"
    },
    {
      "type": "WEB",
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-240048-1"
    },
    {
      "type": "WEB",
      "url": "http://support.apple.com/kb/HT3026"
    },
    {
      "type": "WEB",
      "url": "http://support.apple.com/kb/HT3129"
    },
    {
      "type": "WEB",
      "url": "http://support.citrix.com/article/CTX117991"
    },
    {
      "type": "WEB",
      "url": "http://support.citrix.com/article/CTX118183"
    },
    {
      "type": "WEB",
      "url": "http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL\u0026id=762152"
    },
    {
      "type": "WEB",
      "url": "http://up2date.astaro.com/2008/08/up2date_7202_released.html"
    },
    {
      "type": "WEB",
      "url": "http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0231"
    },
    {
      "type": "WEB",
      "url": "http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0018"
    },
    {
      "type": "WEB",
      "url": "http://www.bluecoat.com/support/security-advisories/dns_cache_poisoning"
    },
    {
      "type": "WEB",
      "url": "http://www.caughq.org/exploits/CAU-EX-2008-0002.txt"
    },
    {
      "type": "WEB",
      "url": "http://www.caughq.org/exploits/CAU-EX-2008-0003.txt"
    },
    {
      "type": "WEB",
      "url": "http://www.cisco.com/en/US/products/products_security_advisory09186a00809c2168.shtml"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2008/dsa-1603"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2008/dsa-1604"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2008/dsa-1605"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2008/dsa-1619"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2008/dsa-1623"
    },
    {
      "type": "WEB",
      "url": "http://www.doxpara.com/?p=1176"
    },
    {
      "type": "WEB",
      "url": "http://www.doxpara.com/DMK_BO2K8.ppt"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=isg1IZ26667"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=isg1IZ26668"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=isg1IZ26669"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=isg1IZ26670"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=isg1IZ26671"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=isg1IZ26672"
    },
    {
      "type": "WEB",
      "url": "http://www.ipcop.org/index.php?name=News\u0026file=article\u0026sid=40"
    },
    {
      "type": "WEB",
      "url": "http://www.isc.org/index.pl?/sw/bind/bind-security.php"
    },
    {
      "type": "WEB",
      "url": "http://www.kb.cert.org/vuls/id/800113"
    },
    {
      "type": "WEB",
      "url": "http://www.kb.cert.org/vuls/id/MIMG-7DWR4J"
    },
    {
      "type": "WEB",
      "url": "http://www.kb.cert.org/vuls/id/MIMG-7ECL8Q"
    },
    {
      "type": "WEB",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:139"
    },
    {
      "type": "WEB",
      "url": "http://www.nominum.com/asset_upload_file741_2661.pdf"
    },
    {
      "type": "WEB",
      "url": "http://www.novell.com/support/viewContent.do?externalId=7000912"
    },
    {
      "type": "WEB",
      "url": "http://www.openbsd.org/errata42.html#013_bind"
    },
    {
      "type": "WEB",
      "url": "http://www.openbsd.org/errata43.html#004_bind"
    },
    {
      "type": "WEB",
      "url": "http://www.phys.uu.nl/~rombouts/pdnsd.html"
    },
    {
      "type": "WEB",
      "url": "http://www.phys.uu.nl/~rombouts/pdnsd/ChangeLog"
    },
    {
      "type": "WEB",
      "url": "http://www.redhat.com/support/errata/RHSA-2008-0789.html"
    },
    {
      "type": "WEB",
      "url": "http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/VU800113.html"
    },
    {
      "type": "WEB",
      "url": "http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/495289/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/495869/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/30131"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id?1020437"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id?1020438"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id?1020440"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id?1020448"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id?1020449"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id?1020548"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id?1020558"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id?1020560"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id?1020561"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id?1020575"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id?1020576"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id?1020577"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id?1020578"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id?1020579"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id?1020651"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id?1020653"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id?1020702"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id?1020802"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id?1020804"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/usn-622-1"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/usn-627-1"
    },
    {
      "type": "WEB",
      "url": "http://www.unixwiz.net/techtips/iguide-kaminsky-dns-vuln.html"
    },
    {
      "type": "WEB",
      "url": "http://www.us-cert.gov/cas/techalerts/TA08-190A.html"
    },
    {
      "type": "WEB",
      "url": "http://www.us-cert.gov/cas/techalerts/TA08-190B.html"
    },
    {
      "type": "WEB",
      "url": "http://www.us-cert.gov/cas/techalerts/TA08-260A.html"
    },
    {
      "type": "WEB",
      "url": "http://www.vmware.com/security/advisories/VMSA-2008-0014.html"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2019/references"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2023/references"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2025/references"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2029/references"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2030/references"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2050/references"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2051/references"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2052/references"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2055/references"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2092/references"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2113/references"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2114/references"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2123/references"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2139/references"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2166/references"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2195/references"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2196/references"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2197/references"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2268"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2291"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2334"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2342"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2377"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2383"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2384"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2466"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2467"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2482"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2525"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2549"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2558"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2582"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2584"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2009/0297"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2009/0311"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2010/0622"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-R6X4-QP59-VF35

Vulnerability from github – Published: 2026-05-12 15:31 – Updated: 2026-05-14 18:32
VLAI
Details

CWE‑331 Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session‑management protections.

Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-4827"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-331"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-12T13:17:35Z",
    "severity": "HIGH"
  },
  "details": "CWE\u2011331 Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session\u2011management protections.",
  "id": "GHSA-r6x4-qp59-vf35",
  "modified": "2026-05-14T18:32:47Z",
  "published": "2026-05-12T15:31:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4827"
    },
    {
      "type": "WEB",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-132-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2026-132-02.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-RF22-J4Q7-F2F8

Vulnerability from github – Published: 2022-05-13 01:23 – Updated: 2022-05-13 01:23
VLAI
Details

Sagemcom F@st 5260 routers using firmware version 0.4.39, in WPA mode, default to using a PSK that is generated from a 2-part wordlist of known values and a nonce with insufficient entropy. The number of possible PSKs is about 1.78 billion, which is too small.

Severity
5.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2019-9555"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-331"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-03-05T23:29:00Z",
    "severity": "MODERATE"
  },
  "details": "Sagemcom F@st 5260 routers using firmware version 0.4.39, in WPA mode, default to using a PSK that is generated from a 2-part wordlist of known values and a nonce with insufficient entropy. The number of possible PSKs is about 1.78 billion, which is too small.",
  "id": "GHSA-rf22-j4q7-f2f8",
  "modified": "2022-05-13T01:23:04Z",
  "published": "2022-05-13T01:23:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9555"
    },
    {
      "type": "WEB",
      "url": "https://seclists.org/fulldisclosure/2019/Mar/12"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-RF68-2835-83VW

Vulnerability from github – Published: 2022-05-24 16:55 – Updated: 2024-04-04 01:52
VLAI
Details

The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2019-15847"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-331"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-09-02T23:15:00Z",
    "severity": "HIGH"
  },
  "details": "The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same.",
  "id": "GHSA-rf68-2835-83vw",
  "modified": "2024-04-04T01:52:18Z",
  "published": "2022-05-24T16:55:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15847"
    },
    {
      "type": "WEB",
      "url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91481"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00056.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00057.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00058.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-RG76-677X-56Q9

Vulnerability from github – Published: 2026-08-07 18:48 – Updated: 2026-08-07 18:48
VLAI
Summary
crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain
Details

Summary

CryptoJS.lib.WordArray.random() in affected versions is not a cryptographically secure random number generator. Nominal requests for 128 or 256 bits of entropy produce effective search spaces of approximately 2^39 and 2^47 possibilities — small enough to enumerate on commodity hardware.

Coinspect's Ill Bloom investigation confirmed that downstream wallet applications used this function as the entropy source for BIP39 recovery phrases.

An application is affected only if it uses the vulnerable function to generate security-sensitive values.

Merely depending on crypto-js < 4.0.0 is not sufficient to be exploitable.

Details

The affected implementation used a custom variation of George Marsaglia's Multiply-With-Carry PRNG, seeded from Math.random(). It was introduced in 3.1.2-4 (June 2014, commit brix/crypto-js@ff1f003) in response to issue #7, and was present in every 3.x release except 3.2.0 and 3.2.1. That change was reverted in 3.3.0 because it was considered a breaking change, so projects tracking the 3.x line could resolve to newer versions that still contained the weak generator.

4.0.0 replaced the generator with the platform's native cryptographic API.

Applying PBKDF2, another KDF, or a cryptographic hash after the vulnerable generator does not restore missing entropy.

Proof of concept

Coinspect reproduced the attack end to end:

  1. Reimplemented the affected WordArray.random() behavior.
  2. Enumerated the feasible outputs of the underlying PRNG.
  3. Converted candidate entropy values into valid BIP39 recovery phrases.
  4. Derived private keys and addresses across the relevant derivation paths and networks.
  5. Compared derived addresses against public blockchain data.
  6. Recovered the private keys controlling funded addresses.

Impact

An attacker can enumerate the reduced output space and recover security-sensitive values generated through the affected function.

Coinspect documented coordinated drain waves affecting addresses derived from vulnerable recovery phrases. As of July 13, 2026, the measured lower bound of stolen assets across the two events was approximately $5M.

The consequences are persistent:

  • Updating an affected library or wallet does not strengthen a previously generated secret.
  • Importing the same recovery phrase into an updated software or hardware wallet does not remediate the issue.
  • Previously generated secrets may remain exploitable indefinitely.
  • Future deposits to an affected address may also be stolen.
  • Assets may remain exposed across networks or derivation paths that have not yet shown suspicious activity.

Remediation

For projects:

  1. Upgrade crypto-js to version 4.0.0 or later. Where possible, replace CryptoJS randomness with the native Web Crypto API or Node.js crypto module.
  2. Audit direct, downstream, and transitive dependencies for versions of crypto-js matching < 4.0.0.
  3. Determine whether CryptoJS.lib.WordArray.random() was used to generate any security-sensitive values.
  4. Identify the time periods and application versions during which the vulnerable generation path was present.
  5. Treat all long-term secrets generated through an affected path as compromised and rotate them.
  6. Notify affected users that installing an update is insufficient when a long-term secret was generated by the vulnerable code.

For wallet users: create a new wallet with a newly generated recovery phrase from a trustworthy source and migrate assets to addresses derived from it. Do not import the existing recovery phrase into the new wallet.

Public address checker

Coinspect provides a public checker for addresses identified in the known Ill Bloom exposed-address datasets:

https://illbloom.org/

Only public blockchain addresses should be entered. Users must never enter a recovery phrase, seed phrase, mnemonic, private key, password, or wallet backup file.

A match indicates that funds controlled by the same recovery phrase may be at immediate risk. A negative result only means that the submitted address was not found in the currently published datasets.

References

Severity
9.0 (Critical)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "crypto-js"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-71851"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-331",
      "CWE-334",
      "CWE-338"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-07T18:48:59Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Summary\n\n`CryptoJS.lib.WordArray.random()` in affected versions is not a cryptographically secure random number generator. Nominal requests for 128 or 256 bits of entropy produce effective search spaces of approximately 2^39 and 2^47 possibilities \u2014 small enough to enumerate on commodity hardware.\n\nCoinspect\u0027s [Ill Bloom](https://www.coinspect.com/blog/ill-bloom-investigation/) investigation confirmed that downstream wallet applications used this function as the entropy source for BIP39 recovery phrases.\n\n**An application is affected only if it uses the vulnerable function to generate security-sensitive values.** \n\nMerely depending on `crypto-js \u003c 4.0.0` is not sufficient to be exploitable.\n\n### Details\n\nThe affected implementation used a custom variation of George Marsaglia\u0027s Multiply-With-Carry PRNG, seeded from `Math.random()`. It was introduced in 3.1.2-4 (June 2014, commit brix/crypto-js@ff1f003) in response to issue \\#7, and was present in every 3.x release except 3.2.0 and 3.2.1. That **change was reverted in 3.3.0** because it was considered a breaking change, so projects tracking the 3.x line could resolve to newer versions that still contained the weak generator. \n\n4.0.0 replaced the generator with the platform\u0027s native cryptographic API.\n\nApplying PBKDF2, another KDF, or a cryptographic hash after the vulnerable generator does not restore missing entropy.\n\n### Proof of concept\n\nCoinspect reproduced the attack end to end:\n\n1. Reimplemented the affected `WordArray.random()` behavior.  \n2. Enumerated the feasible outputs of the underlying PRNG.  \n3. Converted candidate entropy values into valid BIP39 recovery phrases.  \n4. Derived private keys and addresses across the relevant derivation paths and networks.  \n5. Compared derived addresses against public blockchain data.  \n6. Recovered the private keys controlling funded addresses.\n\n### Impact\n\nAn attacker can enumerate the reduced output space and recover security-sensitive values generated through the affected function.\n\nCoinspect documented coordinated drain waves affecting addresses derived from vulnerable recovery phrases. As of July 13, 2026, the measured lower bound of stolen assets across the two events was approximately $5M.\n\nThe consequences are persistent:\n\n* Updating an affected library or wallet does not strengthen a previously generated secret.  \n* Importing the same recovery phrase into an updated software or hardware wallet does not remediate the issue.  \n* Previously generated secrets may remain exploitable indefinitely.  \n* Future deposits to an affected address may also be stolen.  \n* Assets may remain exposed across networks or derivation paths that have not yet shown suspicious activity.\n\n### Remediation\n\n**For projects:**\n\n1. Upgrade `crypto-js` to version `4.0.0` or later. Where possible, replace CryptoJS randomness with the native Web Crypto API or Node.js `crypto` module.  \n2. Audit direct, downstream, and transitive dependencies for versions of `crypto-js` matching `\u003c 4.0.0`.  \n3. Determine whether `CryptoJS.lib.WordArray.random()` was used to generate any security-sensitive values.  \n4. Identify the time periods and application versions during which the vulnerable generation path was present.  \n5. Treat all long-term secrets generated through an affected path as compromised and rotate them.  \n6. Notify affected users that installing an update is insufficient when a long-term secret was generated by the vulnerable code.\n\n**For wallet users:** create a new wallet with a newly generated recovery phrase from a trustworthy source and migrate assets to addresses derived from it. Do not import the existing recovery phrase into the new wallet.\n\n### Public address checker\n\nCoinspect provides a public checker for addresses identified in the known Ill Bloom exposed-address datasets:\n\n[https://illbloom.org/](https://illbloom.org/)\n\nOnly public blockchain addresses should be entered. Users must **never enter a recovery phrase**, seed phrase, mnemonic, private key, password, or wallet backup file.\n\nA match indicates that funds controlled by the same recovery phrase may be at immediate risk. A negative result only means that the submitted address was not found in the currently published datasets.\n\n### References\n\n* Ill Bloom research site and public address checker:  \n  [https://illbloom.org/](https://illbloom.org/)  \n* Coinspect investigation overview:  \n  [https://www.coinspect.com/blog/ill-bloom-investigation/](https://www.coinspect.com/blog/ill-bloom-investigation/)  \n* CryptoJS issue \\#7 \u2014 `randomBytes is not random enough`:  \n  [https://github.com/brix/crypto-js/issues/7](https://github.com/brix/crypto-js/issues/7)  \n* Commit introducing the MWC-based implementation:  \n  [https://github.com/brix/crypto-js/commit/ff1f0032ff58aedfcc44eb6aa7b2c78207a98009](https://github.com/brix/crypto-js/commit/ff1f0032ff58aedfcc44eb6aa7b2c78207a98009)  \n* Changes between CryptoJS `3.3.0` and `4.0.0`:  \n  [https://github.com/brix/crypto-js/compare/3.3.0...4.0.0](https://github.com/brix/crypto-js/compare/3.3.0...4.0.0)  \n* Downstream `ferrumnet/bip39` fork:  \n  [https://github.com/ferrumnet/bip39](https://github.com/ferrumnet/bip39)",
  "id": "GHSA-rg76-677x-56q9",
  "modified": "2026-08-07T18:48:59Z",
  "published": "2026-08-07T18:48:59Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/brix/crypto-js/security/advisories/GHSA-rg76-677x-56q9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/brix/crypto-js/commit/b405ff597fb3ac76a7bdfbc72dca10ba1079b1d5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/brix/crypto-js"
    },
    {
      "type": "WEB",
      "url": "https://www.coinspect.com/blog/ill-bloom-investigation"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain"
}

GHSA-RGVP-66GG-99PP

Vulnerability from github – Published: 2022-05-17 05:17 – Updated: 2025-07-09 21:30
VLAI
Details

Post Oak AWAM Bluetooth Reader Traffic System does not use a sufficient source of entropy for private keys, which makes it easier for man-in-the-middle attackers to spoof a device by predicting a key value.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2012-4687"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-331"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2012-12-08T15:55:00Z",
    "severity": "HIGH"
  },
  "details": "Post Oak AWAM Bluetooth Reader Traffic System does not use a sufficient source of entropy for private keys, which makes it easier for man-in-the-middle attackers to spoof a device by predicting a key value.",
  "id": "GHSA-rgvp-66gg-99pp",
  "modified": "2025-07-09T21:30:55Z",
  "published": "2022-05-17T05:17:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-4687"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-12-335-01"
    },
    {
      "type": "WEB",
      "url": "http://www.postoaktraffic.com/contact.aspx"
    },
    {
      "type": "WEB",
      "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-335-01.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}
Mitigation
Implementation

Determine the necessary entropy to adequately provide for randomness and predictability. This can be achieved by increasing the number of bits of objects such as keys and seeds.

CAPEC-59: Session Credential Falsification through Prediction

This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.

← Back to the CWE list