CVE-2025-62710 Sakai kernel-impl: predictable PRNG used to generate server‑side encryption key in EncryptionUtilityServiceImpl

What is CVE-2025-62710?

CVE-2025-62710 is a medium-severity vulnerability in sakaiproject sakai, published on 22 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Sakai is a Collaboration and Learning Environment. Prior to versions 23.5 and 25.0, EncryptionUtilityServiceImpl initialized an AES256TextEncryptor password (serverSecretKey) using RandomStringUtils with the default java.util.Random. java.util.Random is a non‑cryptographic PRNG and can be predicted from limited state/seed information (e.g., start time window), substantially reducing the effective search space of the generated key. An attacker who can obtain ciphertexts (e.g., exported or at‑rest strings protected by this service) and approximate the PRNG seed can feasibly reconstruct the serverSecretKey and decrypt affected data. SAK-49866 is patched in Sakai 23.5, 25.0, and trunk.

Weakness: CWE-337

Which versions are affected by CVE-2025-62710?

2 open source packages ship an affected version, including org.sakaiproject.kernel:sakai-kernel-impl. It affects 1 product.

Products include Sakailms Sakai.

How do I fix CVE-2025-62710?

No fix has been published for CVE-2025-62710 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-62710 being exploited?

There is no known exploitation of CVE-2025-62710 in the wild and no public exploit code.

Other vulnerabilities in sakaiproject sakai

• CVE-2024-47876 Sakai: Kernel users created with type roleview can login as a normal user High 8.7
• CVE-2019-16148 Cross-site scripting in Sakai Medium 6.1
• CVE-2026-33402 SAK-52311: Sakai site-manage group titles can contain XSS content Low 1.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gr7h-xw4f-wh86.