AIKIDO-2026-554041

TL;DR

CryptoJS.lib.WordArray.random() generates bytes with a Multiply-With-Carry PRNG seeded from Math.random() instead of a cryptographically secure source, so requests for 128- or 256-bit values collapse to roughly 2^39 and 2^47 feasible outputs. An attacker who knows that security-sensitive material was produced through this path can enumerate those outputs and recover secrets such as BIP39 recovery phrases and derived keys. Applying PBKDF2, another KDF, or a hash after the generator does not restore the missing entropy, and upgrading the library alone does not protect values already generated this way. The fix replaces the custom PRNG with the platform native cryptographic random API; any keys, tokens, or recovery phrases produced through the vulnerable path must be treated as compromised and rotated.