CVE-2026-125362: Seahub through 14.0.10 Predictable Share Link Passwords via Batch Endpoint
Seahub through 14.0.10 contains a weak randomness vulnerability in MultiShareLinksBatch.post() that generates batch share link passwords using Python's non-cryptographic random.choices(). Authenticated users permitted to create share links can request many generated passwords via the multi-share-links batch endpoint, recover the Mersenne Twister state, and predict other users' share link passwords.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who has permission to create share links can exploit it. The attacker must be able to make many requests to the multi-share-links batch endpoint to obtain generated passwords.
What must an attacker do to predict another user's share-link password?
The attacker needs to collect enough batch-generated passwords to recover the state of Python's Mersenne Twister random-number generator. They can then use that recovered state to predict share-link passwords generated for other users.
What information could be exposed?
The vulnerability can expose share-link passwords generated by the affected batch endpoint. The provided data indicates low confidentiality impact and no integrity or availability impact.