### [CVE-2019-10755](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10755)
![](https://img.shields.io/static/v1?label=Product&message=PAC4J%20For%20SAML%20Protocol&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Insecure%20Randomness&color=brighgreen)

### Description

The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml.

### POC

#### Reference
- https://snyk.io/vuln/SNYK-JAVA-ORGPAC4J-467407
- https://snyk.io/vuln/SNYK-JAVA-ORGPAC4J-467407

#### Github
No PoCs found on GitHub currently.