CodeVetter · local evidence export

Predictable PRNG for security tokens in Java

codevetter-public-benchmark/java-insecure-random

detected · high confidence

Verification

Code reviewcompleted

Qualified static finding recorded.

Executable testnot verified

No exact-current runtime evidence is included.

Audiencenot run

No audience validation occurred.

Finding

highbenchmark ground truth

insecure random

Reset tokens are generated with java.util.Random, a predictable PRNG whose seed is recoverable from observed outputs, allowing token forgery. SecureRandom should be used instead.

source.java:10