{"id":"CVE-2019-10908","details":"In Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang.RandomStringUtils, which uses java.util.Random internally. This PRNG has a 48-bit seed that can easily be bruteforced, leading to trivial privilege escalation attacks.","modified":"2026-05-16T04:01:30.516635675Z","published":"2019-04-07T14:29:00.427Z","database_specific":{},"references":[{"type":"FIX","url":"https://github.com/airsonic/airsonic/commit/61c842923a6d60d4aedd126445a8437b53b752c8"}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}