The vulnerability arises from the Random Value Property Source in Spring Boot, which uses weak pseudo‑random number generators to produce values labeled as secrets. Generators such as ${random.int} and ${random.long} produce predictable numeric outputs within a limited range, making them unsuitable for cryptographic keys, passwords, or other secrets that must remain confidential. This weakness is classified as CWE‑330: Use of Cryptographically Weak or Predictable Pseudorandom Number Generator.

Spring Boot releases 4.0.0 through 4.0.5, 3.5.0 through 3.5.13, 3.4.0 through 3.4.15, 3.3.0 through 3.3.18, and 2.7.0 through 2.7.32 are affected. The flaw is fixed in 4.0.6, 3.5.14, 3.4.16, 3.3.19, and 2.7.33 respectively. Any application that relies on the Random Value Property Source to generate secrets should be treated as vulnerable unless it has been upgraded or the source replaced with a secure generator.

The CVSS base score of 4.8 indicates moderate severity, and the EPSS score is not available. The vulnerability is not present in CISA’s KEV catalog, implying no confirmed public exploitation. The attack vector, while not explicitly documented, is likely to be local or network based on configuration access. An attacker who can influence or observe the application’s configuration or logging streams may predict or discover the generated secret values due to the predictability of the weak PRNG. Consequently, the risk remains significant enough to warrant prompt mitigation.