AIKIDO-2025-10835

TL;DR

Affected versions of this package are vulnerable to Insecure Randomness in Lock Tokens due to the use of Math.random() for generating lock tokens, which is not cryptographically secure and produces predictable values. An attacker could exploit this by predicting the lock tokens to bypass authentication mechanisms, potentially leading to unauthorized access, privilege escalation, or data integrity issues.