Insufficient Entropy
Applications that use predictable or weak random number generators for security-sensitive operations (token generation, key creation, session IDs) can be compromised by attackers who predict the generated values.
Overview
Many applications use random values for security-critical operations but rely on weak pseudo-random number generators (PRNGs) instead of cryptographically secure alternatives. If an attacker can predict the output of the random number generator, they can forge tokens, predict session IDs, or bypass security controls.
Impact
Session hijacking, token prediction, CSRF token bypass, password reset token prediction.
Remediation
Use cryptographically secure random number generators (CSPRNG), avoid Math.random() for security purposes, and ensure sufficient entropy for all security-sensitive values.
Use os.urandom() or secrets module in Python
Use crypto.randomBytes() in Node.js
Never use Math.random() for security-sensitive values
Ensure sufficient token length (minimum 128 bits of entropy)
Audit all token generation code for entropy sources
Related SuperClue scanner checks
These scanner checks look for signs of Insufficient Entropy. What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works