Predictable Seed in Pseudo-Random Number Generator (PRNG) in Apache Druid - CVE-2025-59390
Published: November 28, 2025
Vulnerability identifier: #VU118821
CSH Severity: High
CVSS v4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-59390
CWE-ID: CWE-337
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication.
The vulnerability exists due to Apache Druid’s Kerberos authenticator uses a weak fallback secret when the `druid.auth.authenticator.kerberos.cookieSignatureSecret` configuration is not explicitly set. As a result the secret is generated using `ThreadLocalRandom`, which is not a crypto-graphically secure random number generator.A remote attacker can predict or brute force the secret used to sign authentication cookies, enabling token forgery or authentication bypass.
Affected software
Apache Druid
How to mitigate CVE-2025-59390
Install updates from vendor's website.
Apache Druid - update to 35.0.0