What is Generation of Predictable Numbers (CWE-340)?

TL;DR: Generation of Predictable Numbers or Identifiers (CWE-340) occurs when a product uses a scheme that generates numbers or identifiers that are more predictable than required, potentially allowing attackers to guess or exploit these values. To fix CWE-340 vulnerabilities, use cryptographically secure random number generators to generate unpredictable numbers or identifiers.

At-a-Glance

What is Generation of Predictable Numbers or Identifiers?

Generation of Predictable Numbers or Identifiers (CWE-340) occurs when a product uses a scheme that generates numbers or identifiers that are more predictable than required. This can potentially allow attackers to guess or exploit these values, leading to unauthorized access or data breaches.

As defined by the MITRE Corporation under CWE-340, and classified by the OWASP Foundation under A04:2025 - Cryptographic Failures, Generation of Predictable Numbers or Identifiers is a type of cryptographic failure that occurs when a product uses a predictable number generator or allows user input to influence the generation of numbers or identifiers.

Quick Summary

Generation of Predictable Numbers or Identifiers (CWE-340) is a type of cryptographic failure that can allow attackers to guess or exploit predictable numbers or identifiers. This vulnerability can lead to unauthorized access or data breaches, particularly in applications that handle sensitive information.

Jump to: Quick Summary · Generation of Predictable Numbers or Identifiers Overview · How Generation of Predictable Numbers or Identifiers Works · Business Impact of Generation of Predictable Numbers or Identifiers · Generation of Predictable Numbers or Identifiers Attack Scenario · How to Detect Generation of Predictable Numbers or Identifiers · How to Fix Generation of Predictable Numbers or Identifiers · Framework-Specific Fixes for Generation of Predictable Numbers or Identifiers · How to Ask AI to Check Your Code for Generation of Predictable Numbers or Identifiers · Generation of Predictable Numbers or Identifiers Best Practices Checklist · Generation of Predictable Numbers or Identifiers FAQ · Vulnerabilities Related to Generation of Predictable Numbers or Identifiers · References · Scan Your Own Site

Generation of Predictable Numbers or Identifiers Overview

What: Generation of Predictable Numbers or Identifiers (CWE-340) occurs when a product uses a scheme that generates numbers or identifiers that are more predictable than required.

Why it matters: A CWE-340 vulnerability can allow attackers to guess or exploit predictable numbers or identifiers, potentially leading to unauthorized access or data breaches.

Where it occurs: CWE-340 vulnerabilities can occur in any application that uses predictable number generators or allows user input to influence the generation of numbers or identifiers.

Who is affected: Any application that handles sensitive information, such as financial transactions or personal data, may be affected by CWE-340 vulnerabilities.

Who is NOT affected: Applications that never construct paths/queries/commands from external input are not typically affected by CWE-340 vulnerabilities.

How Generation of Predictable Numbers or Identifiers Works

Root Cause

The root cause of CWE-340 vulnerabilities is the use of predictable number generators or allowing user input to influence the generation of numbers or identifiers.

Attack Flow

1. An attacker attempts to guess or exploit a predictable number or identifier.
2. The product uses a predictable number generator or allows user input to influence the generation of numbers or identifiers, making it easier for the attacker to guess or exploit these values.
3. The attacker gains unauthorized access or exploits the vulnerability.

Prerequisites to Exploit

• Predictable number generators must be used.
• User input must be allowed to influence the generation of numbers or identifiers.

Vulnerable Code

import random

def generate_id():
    return str(random.randint(1, 100))

# This code uses a predictable number generator and allows user input to influence the generation of numbers or identifiers.

Secure Code

import secrets

def generate_id():
    return str(secrets.randbelow(100))

# This code uses a cryptographically secure random number generator to generate unpredictable numbers or identifiers.

Business Impact of Generation of Predictable Numbers or Identifiers

A CWE-340 vulnerability can lead to unauthorized access or data breaches, particularly in applications that handle sensitive information. The business impact of CWE-340 vulnerabilities may include:

• Financial losses due to unauthorized transactions
• Reputation damage due to data breaches
• Compliance issues due to failure to protect sensitive information

Generation of Predictable Numbers or Identifiers Attack Scenario

1. An attacker attempts to guess or exploit a predictable number or identifier.
2. The product uses a predictable number generator or allows user input to influence the generation of numbers or identifiers, making it easier for the attacker to guess or exploit these values.
3. The attacker gains unauthorized access or exploits the vulnerability.

How to Detect Generation of Predictable Numbers or Identifiers

Manual Testing

• Review code for use of predictable number generators
• Check if user input is allowed to influence the generation of numbers or identifiers
• Use automated scanners like PenScan’s SAST and DAST tools to identify potential CWE-340 vulnerabilities

Automated Scanners (SAST/DAST)

Automated scanners can identify potential CWE-340 vulnerabilities by analyzing code for use of predictable number generators or allowing user input to influence the generation of numbers or identifiers. However, dynamic analysis is required to determine if the generated values are actually predictable.

PenScan Detection

PenScan’s scanner engines actively test for this issue, so you can identify and fix vulnerabilities before an attacker does.

False Positive Guidance

When reviewing findings from automated scanners, be sure to consider the context in which the predictable number generator or user input is used. If the generated values are not actually being used in a sensitive manner, it may not be a CWE-340 vulnerability.

How to Fix Generation of Predictable Numbers or Identifiers

• Use cryptographically secure random number generators to generate unpredictable numbers or identifiers.
• Avoid using predictable number generators or allowing user input to influence the generation of numbers or identifiers.

Framework-Specific Fixes for Generation of Predictable Numbers or Identifiers

Java

import java.security.SecureRandom;

public class IdGenerator {
    private static final SecureRandom random = new SecureRandom();

    public static String generateId() {
        return Long.toHexString(random.nextLong());
    }
}

Node.js

const crypto = require('crypto');

function generateId() {
    return crypto.randomBytes(16).toString('hex');
}

Python/Django

import secrets

def generate_id():
    return str(secrets.randbelow(100))

PHP

<?php
$random_number = rand(1, 100);
echo $random_number;
?>

How to Ask AI to Check Your Code for Generation of Predictable Numbers or Identifiers

To ask an AI assistant to check your code for CWE-340 vulnerabilities, you can use the following prompt:

“Review the following [language] code block for potential CWE-340 Generation of Predictable Numbers or Identifiers vulnerabilities and rewrite it using cryptographically secure random number generators: [paste code here].”

Generation of Predictable Numbers or Identifiers Best Practices Checklist

✅ Use cryptographically secure random number generators to generate unpredictable numbers or identifiers. ✅ Avoid using predictable number generators or allowing user input to influence the generation of numbers or identifiers.

Generation of Predictable Numbers or Identifiers FAQ

How do I prevent CWE-340?

You can use cryptographically secure random number generators to generate unpredictable numbers or identifiers.

What are the consequences of a CWE-340 vulnerability?

A CWE-340 vulnerability can allow attackers to guess or exploit predictable numbers or identifiers, potentially leading to unauthorized access or data breaches.

How do I detect CWE-340 vulnerabilities in my code?

You can use automated scanners like PenScan’s SAST and DAST tools to identify potential CWE-340 vulnerabilities in your code.

What is the best way to fix CWE-340 vulnerabilities?

The best way to fix CWE-340 vulnerabilities is to use cryptographically secure random number generators to generate unpredictable numbers or identifiers.

Can I use a simple allowlist to prevent CWE-340 attacks?

No, using a simple allowlist can actually make your code more vulnerable to CWE-340 attacks. Instead, use cryptographically secure random number generators to generate unpredictable numbers or identifiers.

How do I know if my code is vulnerable to CWE-340?

You can use automated scanners like PenScan’s SAST and DAST tools to identify potential CWE-340 vulnerabilities in your code.

What are some common mistakes that lead to CWE-340 vulnerabilities?

Some common mistakes that lead to CWE-340 vulnerabilities include using predictable number generators or allowing user input to influence the generation of numbers or identifiers.

Vulnerabilities Related to Generation of Predictable Numbers or Identifiers

References

• MITRE: CWE-340
• OWASP A04:2025 - Cryptographic Failures
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Generation of Predictable Numbers or Identifiers and other risks before an attacker does.