Skip to content
OpenAdvisories

Weakness (CWE)

CWE-340: Generation of Predictable Numbers or Identifiers

Class Incomplete

The product uses a scheme that generates numbers or identifiers that are more predictable than required.

Source: MITRE CWE-340

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.0
    CVE-2026-11374 Public exploit

    Account Takeover via Predictable SSO Ticket Generation

    In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.

    Zohocorp ManageEngine ADSelfService Plus ManageEngine ADAudit Plus manageengine_m365_manager_plus
  • High 8.9
    CVE-2025-69286 Public exploit

    RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerability

    RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.22.0, the use of an insecure key generation algorithm in the API key and beta (assistant/agent share auth) token generation process allows these tokens to be mutuall…

    InfiniFlow RAGFlow