Loading story…
A critical vulnerability tracked as CVE-2026-71851 was disclosed in the JavaScript cryptography library crypto-js, affecting versions prior to 4.0.0. The flaw lies in CryptoJS.lib.WordArray.random(), which used a custom Multiply-With-Carry pseudorandom number generator seeded with Math.random() rather than a cryptographically secure operating-system entropy source. That design sharply reduced the effective entropy of supposedly strong random outputs, making generated keys, initialization vectors, and other secrets potentially predictable or reconstructable.
The weakness is especially serious for cryptocurrency wallets and decentralized applications that used the function to generate entropy for BIP39 recovery phrases, because attackers may be able to recover private keys and steal funds from affected wallets. Reports assign the issue a CVSS v3.1 score of 9.0 and map it to CWE-331, CWE-338, and CWE-334. The issue is fixed in crypto-js 4.0.0, and secure alternatives cited for randomness generation include browser window.crypto.getRandomValues() and Node.js crypto.randomBytes().
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
GitHub Security Advisories newly received the CVE-2026-71851 entry for the crypto-js weak-PRNG vulnerability. The issue describes reduced entropy in CryptoJS.lib.WordArray.random() that could enable recovery of wallet seed phrases and private keys.
The insufficient-entropy issue in CryptoJS.lib.WordArray.random() was fixed in crypto-js version 4.0.0. The fix replaced the vulnerable behavior present across nearly all 3.x releases.
The vulnerable custom Multiply-With-Carry pseudorandom number generator seeded from Math.random() was introduced in crypto-js version 3.1.2-4, affecting CryptoJS.lib.WordArray.random(). This design weakened entropy for cryptographic secrets generated by downstream applications.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvereports.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A wallet-drain campaign dubbed **Ill Bloom** exploited weak entropy in `CryptoJS.lib.WordArray.random()` to steal at least **$5.69 million** from cryptocurrency users, according to Coinspect. The flaw affected wallet applications that used vulnerable versions of CryptoJS to generate recovery phrases, allowing attackers to guess seed phrases, derive wallet addresses, and drain funds. Coinspect linked two theft waves between May 27 and July 13 to the issue and identified five affected apps: **RRWallet, Bexo Wallet, NanChat, Bitcoin Libre, and Milo**. The underlying problem traces to a long-standing weakness in CryptoJS random-number generation, broadly covered by advisory `GHSA-rg76-677x-56q9` for versions earlier than `4.0.0`, though exploitation depended on whether developers used the function for security-sensitive seed generation. Coinspect warned that simply updating an affected wallet does not secure wallets already created with weak recovery phrases; users must generate a new secure seed phrase and move funds, and additional vulnerable wallet apps may still exist beyond the five publicly named.
Aug 6, 2026
Three high-severity vulnerabilities have been disclosed in the JavaScript cryptography library **jsrsasign**, all affecting versions before `11.1.1` and exposing DSA implementations to signature forgery and private key compromise. `CVE-2026-4600` stems from improper verification in DSA domain-parameter validation within `KJUR.crypto.DSA.setPublic` and related DSA/X.509 verification code, allowing attackers to supply malicious parameters such as `g=1` and `y=1` so forged DSA signatures or X.509 certificates are accepted as valid. The issue is classified as `CWE-347` and carries high confidentiality and integrity impact. Two additional flaws can expose DSA private keys during signing. `CVE-2026-4601` affects `KJUR.crypto.DSA.signWithMessageHash`, where the library can emit invalid signatures when `r` or `s` becomes zero instead of retrying, creating a path to recover the private key. `CVE-2026-4599` affects versions from `7.0.0` through versions before `11.1.1` and is tied to incomplete comparison logic in `getRandomBigIntegerZeroToMax` and `getRandomBigIntegerMinToMax`, which can accept out-of-range values, bias DSA nonces, and likewise enable key recovery. The disclosures were accompanied by upstream commits, pull requests, public writeups, and Snyk advisories, with all three bugs rated for high confidentiality and integrity impact and no direct availability impact.
Jun 29, 2026
A high-severity vulnerability, **CVE-2026-16235**, was disclosed in DRSTEVE's Perl module **`Crypt::Password`**, where versions through **0.28** generate password salts using Perl's built-in **`rand`** function. Because `rand` is predictable and not suitable for cryptographic use, the issue was classified as **CWE-338** and assigned a **CVSS v3.1** score with vector **`AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`**, indicating potentially severe impact if affected applications rely on the module for password handling. The disclosure said there is **no known exploitation** so far, but exploitation would be **automatable** and could have **total technical impact**. Maintainers and users were advised to avoid the module's default salt generation by supplying salts generated with a stronger source such as **`Crypt::URandom::Token`**, and to consider migrating away from `Crypt::Password` entirely because the package reportedly has not been updated since **2012**.
Jul 20, 2026