Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Corteza - #VU156180
Published: October 19, 2026
Vulnerability identifier: #VU156180
CSH Severity: Low
CVSS v4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-338
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to predict security tokens and secrets, potentially gaining unauthorized access to accounts and protected information.
The vulnerability exists due to use of cryptographically weak pseudorandom number generators in Corteza's security-token generation routines when generating password-reset, invitation, email-confirmation, and other security-sensitive values. A remote user can use observed generator outputs or guessable initialization values to attempt to predict valid tokens and secrets, potentially compromising account confidentiality and integrity.
Affected software
Corteza
Remediation
Install security update from vendor's website.
Corteza - update to 2026.9.0