CVE-2026-25726

Cloudreve is a self-hosted file management and sharing system. Prior to version 4.13.0, the application uses the weak pseudo-random number generator math/rand seeded with time.Now().UnixNano() to generate critical security secrets, including the secret_key, and hash_id_salt. These secrets are generated upon first startup and persisted in the database. An attacker can exploit this by obtaining the administrator's account creation time (via public API endpoints) to narrow the search window for the PRNG seed, and use known hashid to validate the seed. By brute-forcing the seed (demonstrated to take <3 hours on general consumer PC), an attacker can predict the secret_key. This allows them to forge valid JSON Web Tokens (JWTs) for any user, including administrators, leading to full account takeover and privilege escalation. This issue has been patched in version 4.13.0.

• CWE-338

• https://github.com/cloudreve/cloudreve/releases/tag/4.13.0Product, Release Notes
• https://github.com/cloudreve/cloudreve/security/advisories/GHSA-f8xp-wvcx-p6f4Mitigation, Vendor Advisory

Published

Apr 3, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25720A vulnerability exists in SenseLive X3050’s web management …5.4
• CVE-2026-25721An OS command injection vulnerability exists in XWEB Pro ve…8.8
• CVE-2026-25722Claude Code is an agentic coding tool. Prior to version 2.0.…9.1
• CVE-2026-25723Claude Code is an agentic coding tool. Prior to version 2.0.…6.5
• CVE-2026-25724Claude Code is an agentic coding tool. Prior to version 2.1.…7.5
• CVE-2026-25725Claude Code is an agentic coding tool. Prior to version 2.1.…10
• CVE-2026-25727time provides date and time handling in Rust. From 0.3.6 to …6.5
• CVE-2026-25728ClipBucket v5 is an open source video sharing platform. Prio…7.5
• CVE-2026-25729DeepAudit is a multi-agent system for code vulnerability dis…6.5
• CVE-2026-25731calibre is an e-book manager. Prior to 9.2.0, a Server-Side …7.8
• CVE-2026-25732NiceGUI is a Python-based UI framework. Prior to 3.7.0, Nice…7.5
• CVE-2026-25733Rucio is a software framework that provides functionality to…5.4