description: Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.
problem types: Insecure Randomness
affected:
{
product: Apereo CAS
vendor: n/a
versions:
status: affected, version: All versions prior to version 6.1.0-RC5
}