Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in FacturaScripts - #VU163117
Published: November 9, 2026
Vulnerability identifier: #VU163117
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-338
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to attempt unauthorized access by predicting security tokens used to protect FacturaScripts accounts.
The vulnerability exists due to the use of PHP's cryptographically weak rand() generator in FacturaScripts' randomString() function when creating session tokens, API keys, and email verification codes. An unauthenticated remote attacker can attempt generator-state recovery to predict these tokens, but successful prediction was not demonstrated and is complicated by truncated output and multi-worker deployments.
Affected software
FacturaScripts
Remediation
Install security update from vendor's website.
FacturaScripts - update to 2026.7