Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Dify - #VU139842
Published: July 28, 2026
Vulnerability identifier: #VU139842
CSH Severity: Medium
CVSS v4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-338
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to predict generated API keys.
The vulnerability exists due to use of a cryptographically weak pseudo-random number generator in the generate_api_key() method and generate_string() function when generating API keys. A remote attacker can predict or reproduce API keys to predict generated API keys.
This issue stems from the use of Python's random module, which relies on the deterministic Mersenne Twister algorithm for security-sensitive key generation.
Affected software
Dify
Remediation
Install security update from vendor's website.
Dify - update to 1.4.2