{"id":"CVE-2021-23451","details":"The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which may allow a brute-force attack.","aliases":["GHSA-6x93-h9g3-9phr"],"modified":"2026-07-08T05:59:24.695420420Z","published":"2022-07-25T14:15:10.260Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"fixed":"3.0.0"}],"source":"CPE_RANGE","vendor_product":"otp-generator_project:otp-generator","cpes":["cpe:2.3:a:otp-generator_project:otp-generator:*:*:*:*:*:node.js:*:*"]},{"extracted_events":[{"fixed":"3.0.0"}],"source":"DESCRIPTION"}]},"references":[{"type":"REPORT","url":"https://github.com/Maheshkumar-Kakade/otp-generator/issues/12"},{"type":"FIX","url":"https://github.com/Maheshkumar-Kakade/otp-generator/commit/b27de1ce439ae7f533cec26677e9698671275b70"},{"type":"FIX","url":"https://security.snyk.io/vuln/SNYK-JS-OTPGENERATOR-1655480"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/maheshkumar-kakade/otp-generator","events":[{"introduced":"0"},{"fixed":"b27de1ce439ae7f533cec26677e9698671275b70"}],"database_specific":{"source":"REFERENCES"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-23451.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}