CVE-2026-125362
Received Received - Intake

Weak Randomness in Seahub Share Link Password Generation

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: VulnCheck

Description
Seahub through 14.0.10 contains a weak randomness vulnerability in MultiShareLinksBatch.post() that generates batch share link passwords using Python's non-cryptographic random.choices(). Authenticated users permitted to create share links can request many generated passwords via the multi-share-links batch endpoint, recover the Mersenne Twister state, and predict other users' share link passwords.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-125362
EUVD
EUVD-2026-120525

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
haiwen seahub From 0 (inc) to 14.0.10 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-338 The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Seahub through version 14.0.10 has a weak randomness vulnerability in the MultiShareLinksBatch.post() function. It generates share link passwords using Python's non-cryptographic random.choices(), which uses the Mersenne Twister algorithm. This makes passwords predictable if enough outputs are observed. Authenticated users can exploit this by requesting many passwords via the batch endpoint to recover the internal state and predict other users' share link passwords.

Detection Guidance

To detect this vulnerability, check if your Seahub instance uses Python's random.choices() for generating share link passwords in the MultiShareLinksBatch.post() endpoint. Inspect the multi_share_links.py file for insecure password generation methods. Monitor API logs for excessive requests to the /api/v2.1/multi-share-links/batch/ endpoint, which may indicate attempts to harvest passwords for state recovery.

Impact Analysis

If you use Seahub's share link feature with auto-generated passwords, an attacker with access to the batch endpoint could predict passwords for your share links. This could allow unauthorized access to shared files or directories. The impact is limited to share links created via the batch endpoint with auto-generated passwords.

Compliance Impact

This vulnerability may impact compliance with GDPR and HIPAA by potentially exposing sensitive data through predictable share link passwords. GDPR requires adequate protection of personal data, while HIPAA mandates safeguards for protected health information. Predictable passwords could lead to unauthorized access, violating these regulations.

Mitigation Strategies

Upgrade Seahub to a version that includes the fix (commit dd3ba0341031fd29cabe4855b548badde861df52). Replace Python's random.choices() with Django's get_random_string() for password generation. Ensure the new implementation uses a cryptographically secure RNG like random.SystemRandom().

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125362. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...