CVE-2017-16028
Cryptographically Weak PRNG in randomatic
react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native. The oauth Random Token is generated using a non-cryptographically strong RNG (Math.random()).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native. The oauth Random Token is generated using a non-cryptographically strong RNG (Math.random()).
- Record
CVE-2017-16028- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-330, CWE-338
- Updated
- 2026-11-02
CVE List No score
react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native. The oauth Random Token is generated using a non-cryptographically strong RNG (Math.random()).
- Record
CVE-2017-16028- Weakness
- CWE-330
- Updated
- 2026-11-02
EUVDEUVD-2018-0518 No score
react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native. The oauth Random Token is generated using a non-cryptographically strong RNG (Math.random()).
- Record
EUVD-2018-0518- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6g33-f262-xjp4
Cryptographically Weak PRNG in randomatic
Affected versions of randomatic generate random values using a cryptographically weak psuedo-random number generator. This may result in predictable values instead of random values as intended.
Recommendation
Update to version 3.0.0 or later.
- Record
GHSA-6g33-f262-xjp4- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-330, CWE-338
- Updated
- 2026-11-02
OSVGHSA-6g33-f262-xjp4
Cryptographically Weak PRNG in randomatic
Affected versions of randomatic generate random values using a cryptographically weak psuedo-random number generator. This may result in predictable values instead of random values as intended.
Recommendation
Update to version 3.0.0 or later.
- Record
GHSA-6g33-f262-xjp4- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-330, CWE-338
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
randomaticnpm |
before 3.0.0 | 3.0.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-16028 is a medium vulnerability (CVSS 5.3) in Randomatic Project Randomatic, published June 4, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.33%, the 71st percentile. Fixed in randomatic 3.0.0.
References
github.com/tableflip/react-native-meteor-oauth/blob/a7eb738b74c469f5db20296b44b7cae4e2337435/src/meteor-oauth.js
nodesecurity.io/advisories/157
nvd.nist.gov/vuln/detail/CVE-2017-16028
npmjs.com/advisories/157