CVE-2026-125362

LOW 3.1

Seahub through 14.0.10 Predictable Share Link Passwords via Batch Endpoint

CVSS Score

3.1

EPSS Score

0.0%

EPSS Percentile

0th

Seahub through 14.0.10 contains a weak randomness vulnerability in MultiShareLinksBatch.post() that generates batch share link passwords using Python's non-cryptographic random.choices(). Authenticated users permitted to create share links can request many generated passwords via the multi-share-links batch endpoint, recover the Mersenne Twister state, and predict other users' share link passwords.

CWE	CWE-338
Vendor	haiwen
Product	seahub
Published	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for haiwen seahub

Be the first to know when new low vulnerabilities affecting haiwen seahub are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

haiwen / seahub

0 ≤ 14.0.10

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/haiwen/seahub/issues/9687 github.com: https://github.com/haiwen/seahub github.com: https://github.com/haiwen/seahub/blob/v14.0.10-pro/seahub/api2/endpoints/multi_share_links.py#L502-L512 github.com: https://github.com/haiwen/seahub/commit/dd3ba0341031fd29cabe4855b548badde861df52 vulncheck.com: https://www.vulncheck.com/advisories/seahub-through-14.0.10-predictable-share-link-passwords-via-batch-endpoint

Credits

George Chen