Use of an insecure pseudo-random number generator

ID

vbnet.predictability.insecure_randomness

Severity

high

Remediation Complexity

medium

Remediation Risk

medium

Remediation Effort

medium

Resource

Predictability

Language

VB.NET

Description

Use of System.Random, an insecure pseudo-random number generator. Its output is predictable and must never be used to generate cryptographic keys, tokens, IVs, salts or any other security-sensitive value. Use System.Security.Cryptography.RandomNumberGenerator (RandomNumberGenerator.Create() or RandomNumberGenerator.Fill/GetBytes) instead.

Rationale

Use of System.Random, an insecure pseudo-random number generator. Its output is predictable and must never be used to generate cryptographic keys, tokens, IVs, salts or any other security-sensitive value. Use System.Security.Cryptography.RandomNumberGenerator (RandomNumberGenerator.Create() or RandomNumberGenerator.Fill/GetBytes) instead.

The following code illustrates a vulnerable pattern detected by this rule:

Public Function GenerateKey() As Byte()
    ' VULNERABLE: Use of an insecure pseudo-random number generator
    Dim rng As New Random()
    Dim key(31) As Byte
    rng.NextBytes(key)
    Return key
End Function

Remediation

Follow secure coding practices and review the references below for detailed remediation guidance.

Configuration

This detector does not need any configuration.

References

© 2026 Xygeni. All rights reserved