CVE-2026-125362

CVE-2026-125362CVE-2026-125362

Description

Seahub through 14.0.10 contains a weak randomness vulnerability in MultiShareLinksBatch.post() that generates batch share link passwords using Python's non-cryptographic random.choices(). Authenticated users permitted to create share links can request many generated passwords via the multi-share-links batch endpoint, recover the Mersenne Twister state, and predict other users' share link passwords.

Scoring

CVSS 3.1 ()
VectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Last modified2026-11-10
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.