Cryptographically Weak PRNG

Overview

All versions of generator-jhipster-kotlin use a Cryptographically Weak PRNG that may lead to account takeover. The package uses a cryptographically insecure method to generate password reset links, which allows an attacker to guess password reset links and takeover accounts.

Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

References

• GitHub Advisory
• GitHub Issue
• Snyk Report
• GitHub Advisory