-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| phpservermon/phpservermon | composer | < 3.6.0 | 3.6.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the use of mt_rand() in the token generation process within newRememberMeCookie. The commit bb10a5f explicitly replaces mt_rand with cryptographically secure random_bytes(64), addressing CWE-1241 (Predictable RNG). While setUserLoggedIn is mentioned in vulnerability descriptions, the actual vulnerable implementation was in newRememberMeCookie which it calls. The high confidence comes from: 1) Direct match between patched code location and vulnerability description 2) mt_rand() being a well-known insecure PRNG 3) Explicit CWE mapping to predictable RNG usage in the commit message.
PHPPHPOngoing coverage of React2Shell