Zennoxa Shield
Rules / PHP
SHIELD-PHP-015

Insecure randomness for security tokens

mediumPHPCWE-338CVSS 6.5

What it detects

rand or mt_rand is used to generate a token or key, producing predictable values.

How to fix

Use random_bytes() or random_int() for cryptographically secure token generation.

Vulnerable — Shield flags thisotp.php
<?php
// generate a one-time code for login verification
function makeOtp(): string {
    $otp = (string) mt_rand(100000, 999999);
    return $otp;
}
Fixed — scans cleanotp.php
<?php
// generate a one-time code for login verification
function makeOtp(): string {
    $otp = (string) random_int(100000, 999999);
    return $otp;
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-PHP-015, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-PHP-015: Insecure randomness for security tokens — Zennoxa Shield