CVE-2025-64097: Elixir Insecure Token Generation Base62
A user/session/API token is generated using `:base62.encode/1` without sourcing entropy from `:crypto.strong_rand_bytes/1`. This pattern produces structurally-predictable tokens (especially when combined with HMAC over user-identifiable inputs) that are brute-forceable or enumerable (CVE-2025-64097, CWE-330). Replace the token body with `:crypto.strong_rand_
Elixirgreprules fetch cve-2025-64097-elixir-insecure-token-generation-base62 --engine opengrepDescription
A user/session/API token is generated using `:base62.encode/1` without sourcing entropy from `:crypto.strong_rand_bytes/1`. This pattern produces structurally-predictable tokens (especially when combined with HMAC over user-identifiable inputs) that are brute-forceable or enumerable (CVE-2025-64097, CWE-330). Replace the token body with `:crypto.strong_rand_
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.