TI-2022-16470 Aliases CVE-2022-36045 GHSA-p4cc-w597-6cpm

Account takeover via cryptographically weak PRNG in NodeBB Forum

MEDIUM 46CWE-330Published 2022-08-31 · Updated 2025-04-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. It utilizes web sockets for instant interactions and real-time notifications. `utils.generateUUID`, a helper function available in essentially all versions of NodeBB (as far back as v1.0.1 and potentially earlier) used a cryptographically insecure Pseudo-random number generator (`Math.random()`), which meant that a specially crafted script combined with multiple invocations of the password reset functionality could enable an attacker to correctly calculate the reset code for an account they do not have access to. This vulnerability impacts all installations of NodeBB. The vulnerability allows for an attacker to take over any account without the involvement of the victim, and as such, the remediation should be applied immediately (either via NodeBB upgrade or cherry-pick of the specific changeset. The vulnerability has been patched in version 2.x and 1.19.x. There is no known workaround, but the patch sets listed above will fully patch the vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01349 71st percentileScored 2026-11-07

Fix Fixed NodeBB (NodeBB): 1.19.8nodebb (npm): 1.19.8, 2.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
NodeBB	NodeBB	before 1.19.8; = 2.0.0	1.19.8	Patch available	CNA
—	nodebb (npm)	before 1.19.8	1.19.8	Patch available	GHSA-p4cc-w597-6cpm
—	nodebb (npm)	2.0.0 to before 2.0.1	2.0.1	Patch available	GHSA-p4cc-w597-6cpm

NodeBB VendorNodeBB Affected before 1.19.8; = 2.0.0 Fixed in 1.19.8 Patch available CNA
nodebb (npm) Vendor— Affected before 1.19.8 Fixed in 1.19.8 Patch available GHSA-p4cc-w597-6cpm
nodebb (npm) Vendor— Affected 2.0.0 to before 2.0.1 Fixed in 2.0.1 Patch available GHSA-p4cc-w597-6cpm

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:nodebb:nodebb::::::::	before 1.19.8	Vulnerable	NodeBB
cpe:2.3:a:nodebb:nodebb:2.0.0:::::::*	2.0.0	Vulnerable	NodeBB

cpe:2.3:a:nodebb:nodebb:*:*:*:*:*:*:*:* Versions before 1.19.8 Vulnerable ·NodeBB
cpe:2.3:a:nodebb:nodebb:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·NodeBB

Remediation

Fix · CNA NodeBB (NodeBB) Fixed in 1.19.8
Fix · GHSA-p4cc-w597-6cpm nodebb (npm) Fixed in 1.19.8 Advisory →
Fix · GHSA-p4cc-w597-6cpm nodebb (npm) Fixed in 2.0.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-36045
2026-10-03 Alias added: GHSA-p4cc-w597-6cpm

References

Patch 2

Advisory 2

Other 1

https://github.com/NodeBB/NodeBB

TI-2023-23124 A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc… CVSS 3.1CRITICAL 9.8
TI-2022-22808 Account takeover via prototype vulnerability CVSS 3.1CRITICAL 9.8
TI-2026-42173 NodeBB - ActivityPub Author Spoofing via Unvalidated attributedTo Mapped to Local User CVSS 4.0HIGH 8.7
TI-2025-32286 NodeBB v4.3.0 is vulnerable to SQL injection in its search-categories API endpoint… CVSS 3.1HIGH 8.6
TI-2023-14416 NodeBB Pre-Authentication Denial-of-Service CVSS 3.1HIGH 7.5
TI-2022-16499 Account takeover via SSO plugins in NodeBB CVSS 3.1HIGH 8.8

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences