Sakai kernel-impl: predictable PRNG used to generate server‑side encryption key in EncryptionUtilityServiceImpl
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Sakai is a Collaboration and Learning Environment. Prior to versions 23.5 and 25.0, EncryptionUtilityServiceImpl initialized an AES256TextEncryptor password (serverSecretKey) using RandomStringUtils with the default java.util.Random. java.util.Random is a non‑cryptographic PRNG and can be predicted from limited state/seed information (e.g., start time window), substantially reducing the effective search space of the generated key. An attacker who can obtain ciphertexts (e.g., exported or at‑rest strings protected by this service) and approximate the PRNG seed can feasibly reconstruct the serverSecretKey and decrypt affected data. SAK-49866 is patched in Sakai 23.5, 25.0, and trunk.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| sakaiproject | sakai | before 23.5; before 25.0 | 23.5, 25.0 | Patch available | CNA |
| — | org.sakaiproject.kernel:sakai-kernel-impl (Maven) | up to 23.3 | — | No fix listed | GHSA-gr7h-xw4f-wh86 |
- sakai Vendorsakaiproject Affected before 23.5; before 25.0 Fixed in 23.5, 25.0 Patch available CNA
- org.sakaiproject.kernel:sakai-kernel-impl (Maven) Vendor— Affected up to 23.3 Fixed in — No fix listed GHSA-gr7h-xw4f-wh86
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sakailms:sakai:*:*:*:*:*:*:*:* | before 23.5 | Vulnerable | sakaiproject |
- cpe:2.3:a:sakailms:sakai:*:*:*:*:*:*:*:* Versions before 23.5 Vulnerable ·sakaiproject
Remediation
- Fix · CNA sakai (sakaiproject) Fixed in 23.5, 25.0
Timeline
- 2026-10-02 Threatist record created from CVE-2025-62710
- 2026-10-03 Alias added: GHSA-gr7h-xw4f-wh86
References
More sakaiproject Sakai vulnerabilities
- TI-2024-32130 Sakai: Kernel users created with type roleview can login as a normal user CVSS 4.0HIGH 8.7
- TI-2019-12135 Sakai through 12.6 allows XSS via a chat user name. CVSS 3.1MEDIUM 6.1
- TI-2026-25799 SAK-52311: Sakai site-manage group titles can contain XSS content CVSS 4.0LOW 1.3
Sources
- CVE-2025-62710 · CVE Program
- CVE-2025-62710 · NVD
- FIRST EPSS
- GHSA-gr7h-xw4f-wh86 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences