Weak random (ARCH4115)

Key java.security.weak-random · Severity warning · Category security · CWE CWE-338

A non-cryptographic PRNG like java.util.Random produces predictable output when used for security-sensitive values such as tokens, keys, salts, or session ids.

Incorrect

String token = Long.toHexString(new Random().nextLong());

Correct

byte[] buf = new byte[32];
SecureRandom.getInstanceStrong().nextBytes(buf);
String token = HexFormat.of().formatHex(buf);

Fix

Use SecureRandom for all security-sensitive values; never use java.util.Random or Math.random.