Weak Randomness Vulnerability in Seahub by Haiwen

CVE-2026-125362

What is CVE-2026-125362?

Seahub versions up to 14.0.10 contain a vulnerability where batch share link passwords are generated using Python's non-cryptographic random.choices(). This flaw allows authenticated users, who can create share links, to generate multiple passwords through the multi-share-links batch endpoint. By exploiting the predictable nature of the random number generator, attackers can recover the Mersenne Twister state, enabling them to anticipate other users' share link passwords and compromise their security.

References