CVE-2021-27913: Use of a Broken or Risky Cryptographic Algorithm

Severity: low (CVSS 3.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-08-30 · updated 2026-06-17
Weakness: CWE-327

Description

The function mt_rand is used to generate session tokens, this function is cryptographically flawed due to its nature being one pseudorandomness, an attacker can take advantage of the cryptographically insecure nature of this function to enumerate session tokens for accounts that are not under his/her control This issue affects: Mautic Mautic versions prior to 3.3.4; versions prior to 4.0.0.

Affected products

Mautic: before 3.3.4; 4.0.0-alpha1, 4.0.0-beta, 4.0.0-rc — fixed in 3.3.4

How to fix

Upgrade to a fixed version: Mautic 3.3.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-27913 or the next vulnerability affects your stack