# CVE-2019-16303: Critical severity vulnerability that affects generator-jhipster

Source: https://junglewise.ai/threats/cve-2019-16303-jhipster-kotlin-insecure-randomness-in-password-generation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-09-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2019-16303 · Severity: low · CVSS 3.1 · Published 2019-09-13

JHipster Kotlin is a code generator that creates backend applications with user authentication and password reset functionality. The generator uses a cryptographically weak random number generator (Java's Random class via Apache Commons) for creating password reset tokens and other security-sensitive values. An attacker who obtains a single password reset token can mathematically reverse-engineer all future tokens, enabling them to take over any user account without authorization.

Technologies: [generator-jhipster (npm)](https://junglewise.ai/threats/technologies/generator-jhipster). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2019-16303 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-16303 being exploited in the wild.

**How severe is CVE-2019-16303?** Low severity, with a CVSS score of 3.1, published 13 September 2019.

**Which products and versions are affected?** generator-jhipster (npm) SEMVER:introduced=0,fixed=6.3.0; generator-jhipster-kotlin (npm) SEMVER:introduced=0,fixed=1.2.0.

**Is there a fix for CVE-2019-16303?** Yes. generator-jhipster (npm): upgrade to 6.3.0 or later; generator-jhipster-kotlin (npm): upgrade to 1.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2019-16303 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2019-16303?** Check whether you run generator-jhipster (npm) or generator-jhipster-kotlin (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- generator-jhipster (npm): upgrade to 6.3.0 or later

  ```sh
  npm install generator-jhipster@6.3.0
  ```

- generator-jhipster-kotlin (npm): upgrade to 1.2.0 or later

  ```sh
  npm install generator-jhipster-kotlin@1.2.0
  ```


## Technical details

JHipster Kotlin uses Apache Commons Lang3's RandomStringUtils class, which relies on java.util.Random for token generation. java.util.Random is not cryptographically secure and uses a linear congruential generator that is predictable given a single output value. The vulnerability (CWE-338) allows an attacker to obtain one password reset token from a target application and use publicly available proof-of-concept tools to determine the seed and predict all past and future token values. This enables account takeover through targeted password reset requests. Affected versions are before 1.2.0; the fix involves replacing RandomStringUtils calls with SecureRandom-backed alternatives as documented in the patch release notes.

## Affected products

- JHipster Kotlin before 1.2.0

## Identifiers

- CVE-2019-16303
- GHSA-j3rh-8vwq-wh84
- GHSA-mwp6-j9wf-968c

## Timeline

- 2019-09-13: disclosed
- 2020-06-26: advisory
- 2020-06-26: patched: v1.2.0 released

## References

- [https://github.com/jhipster/generator-jhipster/security/advisories/GHSA-mwp6-j9wf-968c](https://github.com/jhipster/generator-jhipster/security/advisories/GHSA-mwp6-j9wf-968c)
- [https://github.com/jhipster/jhipster-kotlin/security/advisories/GHSA-j3rh-8vwq-wh84](https://github.com/jhipster/jhipster-kotlin/security/advisories/GHSA-j3rh-8vwq-wh84)

## Related threats

- [JHipster SQL injection in sort parameter of generated reactive applications](https://junglewise.ai/threats/cve-2026-107375-jhipster-sql-injection-in-the-parameter-of-jhipster-generated)
- [JHipster generated applications stored XSS via unrestricted Blob content type](https://junglewise.ai/threats/cve-2026-107303-jhipster-generated-applications-allow-stored-xss-via)
- [JHipster privilege escalation via response manipulation](https://junglewise.ai/threats/cve-2025-43712-jhipster-privilege-escalation-via-response-manipulation)
- [JHipster generator-jhipster timing attack in token validation](https://junglewise.ai/threats/cve-2015-20110-jhipster-generator-jhipster-timing-attack-in-token-validation)
- [JHipster SQL injection in reactive SQL backend entity repositories](https://junglewise.ai/threats/cve-2022-24815-jhipster-sql-injection-in-reactive-sql-backend-entity)