Vulnerability · Published Oct 22, 2025 · Assigned by GitHub_M

CVE-2025-62710Sakai kernel-impl: predictable PRNG used to generate server‑side encryption key in EncryptionUtilityServiceImpl

Medium 5.9

In plain English

A medium-severity security flaw in sakai from sakaiproject. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.2%top 90.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Sakai is a Collaboration and Learning Environment. Prior to versions 23.5 and 25.0, EncryptionUtilityServiceImpl initialized an AES256TextEncryptor password (serverSecretKey) using RandomStringUtils with the default java.util.Random. java.util.Random is a non‑cryptographic PRNG and can be predicted from limited state/seed information (e.g., start time window), substantially reducing the effective search space of the generated key. An attacker who can obtain ciphertexts (e.g., exported or at‑rest strings protected by this service) and approximate the PRNG seed can feasibly reconstruct the serverSecretKey and decrypt affected data. SAK-49866 is patched in Sakai 23.5, 25.0, and trunk.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.sakaiproject.kernel:sakai-kernel-impl	no fix listed	GHSA-gr7h-xw4f-wh86

Affected products (as reported)

Vendor	Product	Versions
sakaiproject	sakai	< 23.5< 25.0

Weakness: CWE-337 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/sakaiproject/sakai/security/advisories/GHSA-gr7h-xw4f-wh86 x_refsource_CONFIRM
https://github.com/sakaiproject/sakai/commit/bde070104b1de01f4a6458dca6d9e0880a0e3c04 x_refsource_MISC