Cryptographically Weak PRNG

Overview

Versions of generator-jhipster use a Cryptographically Weak PRNG that may lead to account takeover. The package uses a cryptographically insecure method to generate password reset links, which allows an attacker to guess password reset links and takeover accounts.

Recommendation

Update to version 6.3.0 or later.

References

• GitHub Advisory
• JHipster Release
• Snyk Report
• GitHub Advisory