Cloudreve, a self‑hosted file‑management platform, uses the standard math/rand pseudo‑random number generator seeded with the system time to create critical security secrets such as the secret_key and hash_id_salt. Because the seed is predictable, an attacker who can determine the administrator’s account creation time—exposed through public API endpoints—can narrow the search for the PRNG seed. By brute‑forcing this seed, the attacker can recover the secret_key, enabling the creation of valid JSON Web Tokens (JWTs) for any user, including administrators. This results in complete account takeover and privilege escalation.

Any installation of Cloudreve prior to version 4.13.0 is affected. The vulnerability exists in the default self‑hosted distribution and applies to all products listed under the Cloudreve vendor/product name.

The CVSS score of 8.1 indicates high severity, and the EPSS score of less than 1% does not negate the practical exploitability demonstrated to require under three hours on a general consumer PC. The vulnerability is not listed in KEV, but the attack vector is remote via exposed APIs, requiring no local access. Given the severity, the likelihood of exploitation is significant for active users running vulnerable versions.