Description
The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml.
Remediation
References
https://snyk.io/vuln/SNYK-JAVA-ORGPAC4J-467407
Related Vulnerabilities
CVE-2016-10726 Vulnerability in maven package org.dspace:dspace-xmlui
CVE-2022-24728 Vulnerability in maven package org.webjars.npm:ckeditor4
CVE-2022-37223 Vulnerability in maven package com.jflyfox:jflyfox_jfinal
CVE-2021-31411 Vulnerability in maven package com.vaadin:flow-server
CVE-2011-1582 Vulnerability in maven package org.apache.tomcat:tomcat-catalina