CVE-2025-62710

Sakai is a Collaboration and Learning Environment. Prior to versions 23.5 and 25.0, EncryptionUtilityServiceImpl initialized an AES256TextEncryptor password (serverSecretKey) using RandomStringUtils with the default java.util.Random. java.util.Random is a non‑cryptographic PRNG and can be predicted from limited state/seed information (e.g., start time window), substantially reducing the effective search space of the generated key. An attacker who can obtain ciphertexts (e.g., exported or at‑rest strings protected by this service) and approximate the PRNG seed can feasibly reconstruct the serverSecretKey and decrypt affected data. SAK-49866 is patched in Sakai 23.5, 25.0, and trunk.

• CWE-337

• https://github.com/sakaiproject/sakai/commit/bde070104b1de01f4a6458dca6d9e0880a0e3c04Patch
• https://github.com/sakaiproject/sakai/security/advisories/GHSA-gr7h-xw4f-wh86Patch, Vendor Advisory

Published

Oct 22, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-62705OpenBao is an open source identity-based secrets management …4.9
• CVE-2025-62706Authlib is a Python library which builds OAuth and OpenID Co…6.5
• CVE-2025-62707pypdf is a free and open-source pure-python PDF library. Pri…7.5
• CVE-2025-62708pypdf is a free and open-source pure-python PDF library. Pri…7.5
• CVE-2025-62709ClipBucket v5 is an open source video sharing platform. In C…8.8
• CVE-2025-6271A vulnerability, which was classified as problematic, was fo…3.3
• CVE-2025-62711Wasmtime is a runtime for WebAssembly. In versions from 38.0…3.1
• CVE-2025-62712JumpServer is an open source bastion host and an operation a…8.1
• CVE-2025-62713Kottster is a self hosted Node.js admin panel. From versions…7.2
• CVE-2025-62714Karmada Dashboard is a general-purpose, web-based control pa…8.7
• CVE-2025-62715ClipBucket v5 is an open source video sharing platform. Vers…5.4
• CVE-2025-62716Plane is open-source project management software. Prior to v…8.1