CVE-2026-25726

CVE-2026-25726 impacts Cloudreve, a self-hosted file management and sharing system, prior to version 4.13.0, due to its use of a weak pseudo-random number generator for critical security secrets like secret_key. An attacker can exploit this by obtaining an administrator's account creation time and brute-forcing the PRNG seed, which has been demonstrated to take less than three hours on a consumer PC, indicating a high attack complexity. This allows the attacker to predict the secret_key, forge valid JSON Web Tokens (JWTs) for any user, including administrators, leading to full account takeover and privilege escalation, reflected in its CVSS score of 8.1 (High). While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered some community discussion.